Language: TypeScript
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
		fastify.addHook('onRequest', async (request, reply) => {
			if (request.url === bullBoardPath || request.url.startsWith(bullBoardPath + '/')) {
				const token = request.cookies.token;
				if (token == null) {
					reply.code(401);
					throw new Error('login required');
				}
				const user = await this.usersRepository.findOneBy({ token });
				if (user == null) {
					reply.code(403);
					throw new Error('no such user');
				}
				const isAdministrator = await this.roleService.isAdministrator(user);
				if (!isAdministrator) {
					reply.code(403);
					throw new Error('access denied');
				}
			}
		});