Mass Account Takeover of 29,000 Accounts by Abusing GraphQL

While testing a GraphQL endpoint, I noticed that introspection was enabled in production.
Running an introspection query exposed the…