First off, take a breath.
Don't assume priority/severity
Start by realizing that you're new, don't know what the company has decided in the past. Your company many have already evaluated this issue and determined that it doesn't matter to them, which would make your severity rating inaccurate. Even if the company cares in general, they may have determined that it doesn't matter for this product, again making your severity rating wrong.
Assuming the company cares, fixing the bug may be much easier than you seem to anticipate. (in the case of obfuscation, it's is typically an automated process, so it's not that big of a deal to add it though the follow-up QA effort may be large. You can go over to https://security.stackexchange.com/ if you want to know more.)
I bring up the above because, when you raise this, you need to do so in a calm manner. Panicking (like calling this 'critical') never helps. In fact, it will make people trust your judgment far less. Don't panic. Stay calm.
You also should be careful to let others prioritize the work and assign the severity. Your job is to report the issue so that others who understand the product and the company and the risk tolerances better can do their jobs.
Ask your boss
You report to someone. Tell them the facts of what you found and why you think it's a problem. Speak factually, without indicating priority, or using any adjectives whatsoever if you can help it. Using scary sounding adjectives will burn you if the company considers code obfuscation to be a non-issue, or has evaluated the performance or maintenance or other cost to be unworthy of the effort.
Your boss may tell you why the company doesn't care. S/he may direct you to someone technical to tell. S/he may tell you to talk to security. If so, give them the same facts you gave your boss.