The GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. This allows an attacker to send a single request containing thousands of aliased resolver calls, leading to excessive server-side resource consumption and service degradation.