Stored self-XSS at m.uber.com

How it was found

There is a stored self-XSS vulnerability at m.uber.com in displaying the uber invite code. If the user sets the invite code at <script>alert(document.domain)</script> value using the main personal area at the uber.com and then signs into the m.uber.com the XSS is fired.

Possible other user exploitation case can be the following: The attacker sends messages to everyone with text:

I have worked at Uber and I know the secret invite code using by employees 
so invite friends using it gets you a $10000 discount for every invited friend. 
Set your invite code to this value:
EMPLOYEE_2016_04_oidkjnfkerjnoidkjnfkerjnoidkjnfkerjnoidkjnfkerjnoidkjnfkerjn<script>eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=='))</script>oidkjnfkerjnoidkjnfkerjnoidkjnfkerjnoidkjnfkerjnoidkjnfkerjn

The unlimited invite code length makes easier to hide a payload inside it. So user will set his invite code to this value and next time he will visit the m.uber.com the XSS will fire.