Spot Bug in this Lua Code

key = "SuperSecretKey@007"

password = "lol!0!b00m"

token = sha1.hmac(key,password)

if (sha1.hmac(key,user_input) == token) then

print ("Login Success")

else

print ("Login Failed")

end

Assume that "user_input" is a variable that comes from the user.