Language: Python
Label: vulnerable
CWE: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Code:
    def test_moderator_can_add_users(self):
        user_should_have_perm(self.moderator, "auth.add_user")
        user_should_have_perm(self.moderator, "auth.change_user")

        # test for https://github.com/kiwitcms/Kiwi/issues/642
        self.client.login(  # nosec:B106:hardcoded_password_funcarg
            username=self.moderator.username, password="admin-password"
        )
        response = self.client.get("/admin/auth/user/add/")
        self.assertEqual(HTTPStatus.OK, response.status_code)

        # only these fields can be edited
        self.assertContains(response, "id_username")
        self.assertContains(response, "id_password1")
        self.assertContains(response, "id_password2")

        response = self.client.post(
            "/admin/auth/user/add/",
            {
                "username": "added-by-moderator",
                "password1": "xo-xo-xo",
                "password2": "xo-xo-xo",
            },
            follow=True,
        )
        self.assertEqual(HTTPStatus.OK, response.status_code)
        self.assertTrue(
            get_user_model().objects.filter(username="added-by-moderator").exists()
        )