Language: Python
Label: vulnerable
CWE: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Code:
    def test_regular_user_cant_add_users(self):
        response = self.client.get("/admin/auth/user/add/")
        self.assertEqual(HTTPStatus.FORBIDDEN, response.status_code)

        response = self.client.post(
            "/admin/auth/user/add/",
            {
                "username": "added-by-regular-user",
                "password1": "xo-xo-xo",
                "password2": "xo-xo-xo",
            },
            follow=True,
        )
        self.assertEqual(HTTPStatus.FORBIDDEN, response.status_code)
        self.assertFalse(
            get_user_model().objects.filter(username="added-by-regular-user").exists()
        )