The Red Hat security response team noticed a bug in Novell's bugzilla here:

https://bugzilla.novell.com/show_bug.cgi?id=302282

I investigated some and found that gdm doesn't properly hide passwords that are requested during autologin.

inside gdm_verify_standalone_pam_conv, it has this:

                case PAM_PROMPT_ECHO_OFF:
...
                       question_msg = g_strdup_printf
("question_msg=%s$$echo=%d", text, TRUE);

The TRUE there should be a FALSE, I think.

I think this is pretty low impact since autologin isn't supposed to ask for a password, afaik.