I can't talk strictly about the legality, but I will tell you I have seen that and much worse. I would say in my experience it is very unlikely anything would happen to the professor unless it is very brazen behavior. Universities are highly opaque and protective and will absolutely go to the mat to defend professors (example).
Nicole Hamilton's post is very insightful but lacks one key detail. There is an important distinction between admission, which the Fisher v. Texas case addresses, and paid research positions, which is probably most relevant to the original question.
Although often paid, grad students are not considered full employees by many universities (often euphemisms like "apprentice personnel" are used). Although NLRB recently ruled that grad students are employees in some sense and therefore can unionize, it is probably a legal gray area as to whether grad students are employees for other purposes. Thus rules like non-discrimination, minimum wage, wrongful termination etc may or may not apply to grad student workers and universities can very effectively navigate this ambiguity.