If password field is not masked, where should this defect be categorized?

I have found a defect where the password field is not masked with stars, where this defect be categorized based on severity and priority?