Language: Go
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
func (a *Auth) AuthPlain(username, password string) ([]string, error) {
	if a.useHelper {
		return []string{username}, external.AuthUsingHelper(a.helperPath, username, password)
	}

	ent, err := Lookup(username)
	if err != nil {
		return nil, err
	}

	if !ent.IsAccountValid() {
		return nil, fmt.Errorf("shadow: account is expired")
	}

	if !ent.IsPasswordValid() {
		return nil, fmt.Errorf("shadow: password is expired")
	}

	if err := ent.VerifyPassword(password); err != nil {
		if err == ErrWrongPassword {
			return nil, module.ErrUnknownCredentials
		}
		return nil, err
	}

	return []string{username}, nil
}