Missing flood control in PasswordReset DataProducer allows unlimited password reset requests

Problem/Motivation

This module has a rate-limiting / flood-control vulnerability in the PasswordReset DataProducer.

Summary

PasswordReset DataProducer (src/Plugin/GraphQL/DataProducer/User/PasswordReset.php) delegates to Drupal core's UserAuthenticationController::resetPassword() with a comment stating the client IP is preserved "for flood control." However, UserAuthenticationController::resetPassword() does not enforce flood control - only login() calls floodControl(). The HTML form equivalent (UserPasswordForm) does implement flood protection, but neither the API controller nor the
DataProducer does.

This allows unlimited password reset emails to be sent to any user account via the GraphQL endpoint.

It was decided by the Drupal security team that this can be posted as public security improvement and does not need a private security issue.

Steps to reproduce

1. Install Drupal 11 with drupal/graphql:5.x-dev
2. Create a custom schema extension that wires the password_reset data producer to a passwordReset mutation
3. Run repeated requests:
   
   

   for i in $(seq 1 100); do
     curl -s -X POST https://your-site.com/graphql
       -H 'Content-Type: application/json'
       -d '{"query":"mutation { passwordReset(email: "victim@example.com") { ... on PasswordResetSuccess { message } } }"}'
   done
   

4. All 100 requests succeed - no rate limiting is applied

Impact

• Inbox flooding of any user account
• Email provider quota exhaustion (SendGrid, Mailgun, etc.)
• The misleading comment in the code ("needed for flood control") prevents discovery of the issue

Proposed fix

Inject UserFloodControlInterface and check flood limits before delegating to the controller, using Drupal's user.flood configuration.

Note

A graphql_test_auth module with GraphQL extension that uses PasswordReset DataProducer is attached