When entering the username/password in the websudo dialog after the user session has expired, JIRA displays all submitted values, including the password in clear text.

This is a breach in security; the password should never be displayed in clear text on a web page.