Omer Iqbal noticed that invalid usernames on Special:PasswordReset were parsed as wikitext.
Although this can't be abused on a typical wiki, in the very special case that a wiki has wgRawHtml enabled, and rely on limiting who can edit to prevent attackers from adding javascript, the username on Special:PasswordReset can be supplied by anyone and will be parsed with wgRawHtml enabled.
Since Special:PasswordReset is whitelisted by default on private wikis, this could potentially lead to an xss crossing a privilege boundary.
The attack is additionally mitigated by default XFO rules preventing that special page from being used in an iframe, so the threat from this is very low.
Omer also reported the "html injection" directly to mozilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1012563
Version: unspecified
Severity: normal