Language: JavaScript
Label: vulnerable
CWE: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Code:
    encode: function (content, k) {
        let encoded = "";
        content = btoa(content);
        content = btoa(content);
        for (i = 0; i < content.length; i++) {
            let a = content.charCodeAt(i);
            let b = a ^ k;
            encoded = encoded + String.fromCharCode(b);
        }
        return btoa(encoded);
    }