Both buttons sign the same "jup.ag wants you to sign in" message from , which is not jup.ag. Watch the wallet popup for the "domain does not match" warning.
Normal line breaks.
Expected: warning appears.
Same text, line breaks replaced with U+2028.
Expected: no warning. That is the bug.
You still click Sign either way. The point is whether the safety warning shows, not whether it signs. Nothing is sent anywhere. Use a browser where the Jupiter extension is installed and unlocked.