In firefox 70.0.1 64 bit (Windows 10), when a master password is set and the user has entered the password during the current session, in the about:logins page you can see all the credentials the user has saved, but you have to enter the master password again to see the saved passwords in plaintext.

If you inspect the website you can change the type from password to text, which will show you the stored password in plaintext without the need of the master password.

This vulnerability allows a malicious actor that has phisical access to the computer of an user to steal all of it's credentials, skipping the master password function.