Language: Go
Label: vulnerable
CWE: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.

Code:
func NewHeadersRequestFromPolicy(policy *config.Policy, hostname string) *HeadersRequest {
	input := new(HeadersRequest)
	input.EnableGoogleCloudServerlessAuthentication = policy.EnableGoogleCloudServerlessAuthentication
	input.EnableRoutingKey = policy.EnvoyOpts.GetLbPolicy() == envoy_config_cluster_v3.Cluster_RING_HASH ||
		policy.EnvoyOpts.GetLbPolicy() == envoy_config_cluster_v3.Cluster_MAGLEV
	input.Issuer = hostname
	input.KubernetesServiceAccountToken = policy.KubernetesServiceAccountToken
	for _, wu := range policy.To {
		input.ToAudience = "https://" + wu.URL.Hostname()
	}
	input.PassAccessToken = policy.GetSetAuthorizationHeader() == configpb.Route_ACCESS_TOKEN
	input.PassIDToken = policy.GetSetAuthorizationHeader() == configpb.Route_ID_TOKEN
	return input
}