AIKIDO-2026-795567

TL;DR

A companion GraphQL system resolver file was not covered by an earlier alias-amplification deduplication fix, leaving several anonymously reachable, expensive resolvers un-deduplicated. Because GraphQL aliasing lets one document invoke the same field many times and the HTTP rate limiter counts requests rather than resolver invocations, a single anonymous request to the system GraphQL endpoint multiplies into many server-side operations. This lets an unauthenticated caller lock out accounts with guessable emails, flood arbitrary recipients with password-reset mail, and force many hashing operations to exhaust CPU. The fix deduplicates the affected system resolvers.