    def clean(self):
        user_id = self.cleaned_data.get('user', None)
        if user_id is None:
            raise forms.ValidationError(
                self.error_messages['invalid_code'],
                code='invalid_code',
            )

        user = get_user_model().objects.get(pk=user_id)
        code = self.cleaned_data['code']
        user = authenticate(self.request, **{
            get_user_model().USERNAME_FIELD: user.username,
            'code': code,
        })

        if not user:
            raise forms.ValidationError(
                self.error_messages['invalid_code'],
                code='invalid_code',
            )

        self.cleaned_data['user'] = user

        return self.cleaned_data
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.