That is the CWE that they identify, but the code seems to store the apparently unhashed password in the database on top of that?