Stored XSS on profile page via Steam display name

Summary

The researcher was able to demonstrate a XSS vulnerability by using their Steam nickname as the payload vector. This was due to insufficient filtering on Linked Account name fields. We pushed out an update that replaces suspicious Linked Account names with a generic string in order to prevent future such attacks.

The user's Steam display name was shown on their profile page, inside a javascript string. I added a </script> to my Steam username to break out and achieve XSS. This was fixed by replacing the whole Steam username with a generic string whenever it looks suspicious.

This exploit required buying a Rockstar game on Steam :)