Language: Go
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
func (ea *ExternalAuth) AuthPlain(username, password string) ([]string, error) {
	accountName, ok := auth.CheckDomainAuth(username, ea.perDomain, ea.domains)
	if !ok {
		return nil, module.ErrUnknownCredentials
	}

	// TODO: Extend process protocol to support multiple authorization identities.
	return []string{username}, AuthUsingHelper(ea.helperPath, accountName, password)
}