func checkKeyValid(r *http.Request, accessKey string) (auth.Credentials, bool, APIErrorCode) {
	if !globalIAMSys.Initialized() && !globalIsGateway {
		// Check if server has initialized, then only proceed
		// to check for IAM users otherwise its okay for clients
		// to retry with 503 errors when server is coming up.
		return auth.Credentials{}, false, ErrServerNotInitialized
	}

	cred := globalActiveCred
	if cred.AccessKey != accessKey {
		// Check if the access key is part of users credentials.
		ucred, ok := globalIAMSys.GetUser(accessKey)
		if !ok {
			return cred, false, ErrInvalidAccessKeyID
		}
		cred = ucred
	}

	claims, s3Err := checkClaimsFromToken(r, cred)
	if s3Err != ErrNone {
		return cred, false, s3Err
	}
	cred.Claims = claims

	owner := cred.AccessKey == globalActiveCred.AccessKey
	return cred, owner, ErrNone
}
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.