Hydroadmin

The exploit is performing a GraphQL batch query brute force attack against the PIN verification system.

• Batch GraphQL Queries: Instead of sending individual PIN attempts, the attack bundled 1,500 PIN verification mutations into a single HTTP request
• Systematic Brute Force: It tested all possible 4-digit PINs (0000-9999) by sending ~7 batch requests total
• Rate Limit Bypass: Since it was only making ~7 HTTP requests (not 10,000), it completely bypassed the HTTP-level rate limiting that was configured for 10 requests per minute

Fix (utils/middleware.js)

The fix is minimal we could disable the batching on graphQL endpoint by:

// Basic middleware setup
export function setupBasicMiddleware(app) {
  app.use(express.json());
  app.use(express.urlencoded({ extended: true }));
  app.use('/challenge/graphql', (req, res, next) => {
  if (Array.isArray(req.body)) {
    return res.status(400).json({ error: 'Batching disabled' });
  }
  next();
});
}