Language: Go
Label: safe
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
func (a *Auth) AuthPlain(username, password string) error {
	ok := len(a.userTbls) == 0
	for _, tbl := range a.userTbls {
		_, tblOk, err := tbl.Lookup(username)
		if err != nil {
			return err
		}
		if tblOk {
			ok = true
			break
		}
	}
	if !ok {
		return errors.New("user not found in tables")
	}

	var lastErr error
	for _, p := range a.passwd {
		if err := p.AuthPlain(username, password); err != nil {
			lastErr = err
			continue
		}

		return nil
	}
	return lastErr
}