Language: Go
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
func (store *Storage) AuthPlain(username, password string) ([]string, error) {
	// TODO: Pass session context there.
	defer trace.StartRegion(context.Background(), "sql/AuthPlain").End()

	accountName, err := prepareUsername(username)
	if err != nil {
		return nil, err
	}

	password, err = precis.OpaqueString.CompareKey(password)
	if err != nil {
		return nil, err
	}

	// TODO: Make go-imap-sql CheckPlain return an actual error.
	if !store.Back.CheckPlain(accountName, password) {
		return nil, module.ErrUnknownCredentials
	}
	return []string{username}, nil
}