There's actually no proof or claim of XSS vulnerability in this bizarre article. Username url confused with special url is a common bug, I've seen it "exploited" on facebook.

▲

solyin 19 hours ago | parent [-]

The exploit I read in the vice.com article is the attackers username or a post could contain "<img src=/signout>" and be unescaped and automatically sign users that loaded that page out. If you don't want to call that an XSS, what would you like to call that?

	▲	neuroticnews25 5 hours ago \| parent \| next [-]
		The claim regarding username is 'i can make my username "signout" and it signs people out when they click my profile', not that it can contain <img src=/signout>, so no html injection here. Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0] Posts could contain a safe subset of html (no scripting) including <img> as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality. >If you don't want to call that an XSS, what would you like to call that? I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended. [0] https://bughunters.google.com/learn/invalid-reports/web-plat... [1] https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc...
	▲	Dylan16807 19 hours ago \| parent \| prev [-]
		> OWASP considers the term cross-site scripting to be a misnomer. It initially was an attack that was used for breaching data across sites, but gradually started to include other forms of data injection attacks.[2] Oh.