keybase.io XSS vulnerability

Vulnerable URL: https://keybase.io//api/1.0/user/lookup.json?usernames=fakeuser1%2cfakeuser2'%22%26%25prompt/XSSPOSED/...

Reflected XSS within the username parameter of the /user/non-system/{username} rest resource

The confluence-rest-plugin has a rest resource to look up "non-system" users which takes in a username. If given username supplied is not found then it is included in an xml error message without being xml encoded and thus is a XSS vector. That is, and other such xml special characters are not...