Is it possible to intercept http authorization passwords in hidden service tor?

Question

Computer networks

Let's say I have a forum. Access to it is possible only through tor using the http protocol. How likely is it that, for example, special services or other smart people can intercept traffic to this service and find out the logins and passwords of users who access this service?
My opinion is that it is technically difficult to implement. Because for example, the Agora store works on http, and if I'm not mistaken, Silk Road 2 also worked on http.
There are also services for proxying traffic from the Internet to the tor network https://tor2web.org/. As I understand it, at the border of such a service, it is quite possible to listen to traffic and intercept authorization. According to my observations, proxying through these services only works on http, it does not go over https.
I would like to hear your opinion.