UserSchema.methods.getToken = function (userAgent) {
    return new Promise((resolve, reject) => {
        var user = this;
        var token = ""
        var query = User.findOne({username: user.username});
        query.exec()
        .then(function(row) {
            if (row && bcrypt.compareSync(user.password, row.password)) {
                var refreshToken = jwt.sign({sessionId: null, username: row.username}, auth.jwtRefreshSecret)
                return User.updateRefreshToken(refreshToken, userAgent)
            }
            else
                throw({fn: 'Unauthorized', message: 'Invalid credentials'});
        })
        .then(row => {
            resolve({token: row.token, refreshToken: row.refreshToken})
        })
        .catch(function(err) {
            reject(err);
        })
    })
}
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.