The "SMTP PASSWORD" in settings for "User & Rights > Invitation" is not masked. See attached photo.  Should probably verify this password is being stored in a secure manner by XWiki and that this problem is only a display issue.