Language: Go
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
func filterIdentity(accounts []string, identity string) ([]string, error) {
	if identity == "" {
		return accounts, nil
	}

	matchFound := false
	for _, acc := range accounts {
		if precis.UsernameCaseMapped.Compare(acc, identity) {
			accounts = []string{identity}
			matchFound = true
			break
		}
	}
	if !matchFound {
		return nil, errors.New("auth: invalid credentials")
	}
	return accounts, nil
}