phpMyFAQ versions before 4.1.3 contain an authentication bypass vulnerability in API v4.0. The vulnerability stems from a default empty api.apiClientToken configuration that allows unauthenticated users to bypass authentication. Attackers can exploit this by sending requests with an empty x-pmf-token header to bypass token validation. This enables unauthorized creation and modification of FAQ entries through vulnerable POST endpoints. The affected endpoints include /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question. Attackers can inject malicious content into the application through these endpoints.