Language: Python
Label: vulnerable
CWE: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Code:
    def test_invalid_form(self):
        response = self.client.post(
            self.register_url,
            {
                "username": "kiwi-tester",
                "password1": "password-1",
                "password2": "password-2",
                "email": "new-tester@example.com",
            },
            follow=False,
        )

        self.assertContains(response, _("The two password fields didn’t match."))
        self.assertEqual(response.status_code, 200)
        self.assertTemplateUsed(response, "registration/registration_form.html")