Username with "_" or space is treated incorrectly

This issue was observed during Bugfest 3.2 testing. There was an existing "folio" user, then a new user "folio_mccoll" was created. When the "folio" user tries to login, we got an error message "Sorry, the information entered does not match our records.". We checked the underlying API calls using Chrome, and noticed below request and response error.
https://okapi-bf32-eu-central-1.folio.ebsco.com/bl-users/login?expandPermissions=true&fullPermissions=true

Another case was reported. In this scenario, one user is named "Anya" and another user is named "Anya Arnold". I see similar API response error.