For those interested in the details: the vulnerability was caused by inadequate invalidation of URLs submitted by users when registering OAuth applications. There was a validation routine on those fields, but the very end of the regex used in that validation allowed any number of arbitrary characters. The test coverage included a variety of invalid URLs, but none that simply put a space after the URL and started a <script> tag.
Just goes to show that you can validate, test, and still not be safe. It took another set of eyes to catch this one.
Unfortunately, the publisher of this blog post did not responsibly disclose the vulnerability to us in advance. We found out about it through other channels.
We would have had the fix live earlier, but as several people noticed in the comments, we had a brief outage.