Jenkins Xooa Plugin versions 0.0.7 and earlier do not mask the Xooa Deployment Token in the global configuration form. This lack of masking increases the risk that an attacker with access to the configuration interface could observe and capture the token, potentially leading to unauthorized use. The vulnerability has a medium severity rating with a CVSS score of 4.3.