Authenticated attackers with `allow run as` enabled can cause a denial of service by exhausting CPU resources. This occurs when arbitrarily deeply nested JSON structures are submitted to the 'POST /security/user/authenticate/run as' endpoint. By repeatedly sending malformed `auth context` bodies with unlimited nesting depth, the API framework consumes excessive CPU, denying service to other API consumers.