Language: Go
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
func (s *SASLAuth) AuthPlain(username, password string) ([]string, error) {
	if len(s.Plain) == 0 {
		return nil, ErrUnsupportedMech
	}

	var lastErr error
	accounts := make([]string, 0, 1)
	for _, p := range s.Plain {
		pAccs, err := p.AuthPlain(username, password)
		if err != nil {
			lastErr = err
			continue
		}

		if s.OnlyFirstID {
			return pAccs, nil
		}
		accounts = append(accounts, pAccs...)
	}

	if len(accounts) == 0 {
		return nil, fmt.Errorf("no auth. provider accepted creds, last err: %w", lastErr)
	}
	return accounts, nil
}