Language: PHP
Label: vulnerable
CWE: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Code:
    public function change_password($data)
    {
        $required = [
            'current_password' => 'Current password required',
            'new_password' => 'New password required',
            'confirm_password' => 'New password confirmation required',
        ];
        $this->di['validator']->checkRequiredParamsForArray($required, $data);
        $this->di['validator']->isPasswordStrong($data['new_password']);

        if ($data['new_password'] != $data['confirm_password']) {
            throw new \Exception('Passwords do not match');
        }

        $client = $this->getIdentity();

        if(!$this->di['password']->verify($data['current_password'], $client->pass)) {
            throw new \Exception('Current password incorrect');
        }

        return $this->getService()->changeClientPassword($client, $data['new_password']);
    }