cruise-config.xml

<?xml version="1.0" encoding="utf-8"?>
<cruise xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="cruise-config.xsd" schemaVersion="115">
  <server artifactsdir="artifacts" agentAutoRegisterKey="9e2fa1e1-f534-48db-98c6-a44ef5b9dd1c" webhookSecret="c4d3d5a9-5511-4ebc-8dd9-ccc81355b7ad" commandRepositoryLocation="default" serverId="43141501-63fa-4023-b1e5-9bc08966bfb5" tokenGenerationKey="3aa9edeb-e3c4-43cd-9cc3-5e68aa09b26c">
    <security>
      <authConfigs>
        <authConfig id="jsdajsdask" pluginId="cd.go.authentication.passwordfile">
          <property>
            <key>PasswordFilePath</key>
            <value>config/password.properties</value>
          </property>
        </authConfig>
      </authConfigs>
      <admins>
        <user>admin</user>
      </admins>
    </security>
    <backup emailOnSuccess="true" emailOnFailure="true" />
  </server>
  <pipelines group="defaultGroup">
    <authorization>
      <view>
        <user>groupadmin</user>
      </view>
      <admins>
        <user>groupadmin</user>
      </admins>
    </authorization>
    <pipeline name="Test">
      <params>
        <param name="xxe">xxe</param>
      </params>
      <materials>
        <git url="https://github.com/arvindsv/faketime.git" />
      </materials>
      <stage name="defaultStage">
        <jobs>
          <job name="defaultJob">
            <tasks>
              <exec command="ls" />
            </tasks>
          </job>
        </jobs>
      </stage>
    </pipeline>
  </pipelines>
</cruise>

password.properties

# Password is "badger"
admin=ThmbShxAtJepX80c2JY1FzOEmUk=
groupadmin=ThmbShxAtJepX80c2JY1FzOEmUk=

$ git clone https://gist.github.com/e4712c7f62965c841cd54e80857ce9fa.git
$ curl -L -o go-server-18.12.0-8127.zip 'https://www.dropbox.com/s/svw78enkzqxyn2b/go-server-18.12.0-8127.zip?dl=1'

$ unzip go-server-18.12.0-8127.zip
$ mkdir go-server-18.12.0/config
$ cp password.properties cruise-config.xml go-server-18.12.0/config
$ cd go-server-18.12.0/config
$ ./server.sh

Then, you can try and reproduce the issue, using groupadmin as the user and badger as the password.