Is creating an authentication-key (mac) from the encryption password a vulnerability? I can think of at least one problem with it - that testing for a correct key (when brute forcing) is simpler with a mac key (at least for short messages) and therefore can help brute force decryption.
It is possible to create both an encryption key and authentication key from a password securely.

It is very likely that an attacker knows part of the plaintext most of the time. That makes it very possible to verify correct guesses of the password, even without verifying an authentication tag (MAC). This is especially true if there are multiple messages to test.

So although it is perfectly possible to verify a MAC key over purely random messages and impossible to do the same for encryption keys, the addition of a MAC should not make much of a difference for structured messages.

For passwords brute forcing can certainly be used, but slightly more advanced techniques such as dictionary attacks may also be used. Usually some form of key strengthening is used to derive master key material. That master key material can then be used to derive an encryption and MAC key.

These keys can be made cryptographically independent from each other. But that doesn't matter much since finding the password is the easiest form of attack and finding the password will of course allow an attacker to calculate both keys.