The GraphQL endpoint accepts batched query requests — multiple operations sent as a JSON array in a single HTTP request. When processed without rate limiting or batch size controls, this allows attackers to multiply their request impact, effectively bypassing per-request rate limits to brute-force credentials, enumerate data, or amplify denial-of-service attacks.

Impacts:

• Bypass of per-request rate limiting controls
• Credential brute-forcing through batched login mutations
• Data enumeration at amplified throughput
• Denial-of-service via large batch payloads

Recommendation:

• Disable batched queries if not explicitly required
• Enforce a maximum batch size (e.g., max 5 operations per request)
• Apply rate limiting at the operation level, not just the HTTP request level
• Monitor for unusually large request bodies to the GraphQL endpoint

• GraphQL Batching Attacks