Language: Go
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
func (a *Auth) AuthPlain(username, password string) ([]string, error) {
	key, err := precis.UsernameCaseMapped.CompareKey(username)
	if err != nil {
		return nil, err
	}

	identities := make([]string, 0, 1)
	if len(a.userTbls) != 0 {
		for _, tbl := range a.userTbls {
			repl, ok, err := tbl.Lookup(key)
			if err != nil {
				return nil, err
			}
			if !ok {
				continue
			}
			if repl != "" {
				identities = append(identities, repl)
			} else {
				identities = append(identities, key)
			}
			if a.onlyFirstID && len(identities) != 0 {
				break
			}
		}
		if len(identities) == 0 {
			return nil, errors.New("plain_separate: unknown credentials")
		}
	}

	var (
		lastErr error
		ok      bool
	)
	for _, pass := range a.passwd {
		passIDs, err := pass.AuthPlain(username, password)
		if err != nil {
			lastErr = err
			continue
		}
		if len(a.userTbls) == 0 {
			identities = append(identities, passIDs...)
		}
		ok = true
	}
	if !ok {
		return nil, lastErr
	}

	return identities, nil
}