🎯 New Report #3287208: DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API
🔺Severity: null
👽 Reporter: hellokbit
⭐️ Reputation: 139
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: 12500
🕐 Submitted: 2025-08-05
⏰ Disclosed: 2026-04-16 12:00:20
📝 Summary: The GraphQL API's 'verifyAccountRecoveryPhoneNumber' mutation was found to be vulnerable to denial-of-service attacks through mutation aliasing. The vulnerability allowed multiple aliases of the same mutation to be included in a single request, causing the server to process each mutation sequentially and increasing the response time linearly. This resource exhaustion issue could potentially have led to service disruption for legitimate users.
📂 Report JSON File: 3287208
@hackeronereports