sections/login/u2f.php

 View::show_header('U2F Authentication'); ?>
 
 <form id="u2f_sign_form" action="login.php" method="post">
-  <input type="hidden" name="username" value="<?=$_POST['username']?>">
-  <input type="hidden" name="password" value="<?=$_POST['password']?>">
+  <input type="hidden" name="username" value="<?=htmlspecialchars($_POST['username'])?>">
+  <input type="hidden" name="password" value="<?=htmlspecialchars($_POST['password'])?>">
   <input type="hidden" name="u2f-request" value='<?=$U2FReq?>'>
   <input type="hidden" name="u2f-response">
 </form>