Reflected XSS in https://eng.uberinternal.com and https://coeshift.corp.uber.internal/

Summary

The base parameter of /oidauth/prompt on multiple uberinternal.com subdomains was not sanitized before being reflected into the page body, making it vulnerable to reflected XSS. Additionally, these pages were affected by a clickjacking vulnerability that made exploitation easier, since a click was required to trigger the XSS.

https://blog.fadyothman.com/how-i-discovered-xss-that-affects-over-20-uber-subdomains/