phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to cre…

phpMyFAQ versions before 4.1.3 contain an authentication bypass vulnerability in API v4.0. The vulnerability stems from a default empty api.apiClientToken configuration that allows unauthenticated users to bypass authentication. Attackers can exploit this by sending requests with an empty x-pmf-token header to bypass token validation. This enables unauthorized creation and modification of FAQ entries through vulnerable POST endpoints. The affected endpoints include /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question. Attackers can inject malicious content into the application through these endpoints.