I suggest you bring this up in an office hour with the security review team and see what they suggest.

Usually the risk is very low if your connection is secured HTTPS from a theoretical perspective. In theory HTTPS connection does encrypt the url parameters.

However the risk is high in practice. The users browser can be compromised.

Example in the browser if screens are recorded then one can see the url Params or in the browser history this will show up and the credentials are then compromised.

Also logging them in the sever can be risky. If server is not protecting these logs and they show up then this is a risk.

I would personally move to POST to mitigate some of the above risks.