Language: TypeScript
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
  async updatePlanId(userId: number, planId: number) {
    const user = await User.findByPk(userId)
    if (!user) throw Errors.USER_NOT_FOUND
    if (userId === 6 && planId === 6) {
      throw Errors.HANDLED_BY_PAYMENT_PROVIDER
    }
    await User.update(
      {
        planId
      },
      {
        where: {
          id: userId
        }
      }
    )
    return true
  }