This API endpoint, /build/{project_name}/_result?lastsuccess=1, expects a lastsuccess query parameter, which can take any value.
Please have a look at the following code: https://github.com/openSUSE/open-build-service/blob/master/src/api/app/controllers/build_controller.rb#L150

The controller is only checking for the presence of the parameter, without validating the type or value it should contain. In this case, the API should restrict the lastsuccess parameter to either true/false or 0/1.