GHSA-gp95-j463-vv28: phpMyFAQ: Default Empty API Token Authentication Bypass

A default empty API client token allows any unauthenticated user to create and modify FAQ entries, categories, and questions via the REST API. The vulnerability exists in all versions since API v4.0 was introduced because the installation process seeds api.apiClientToken with an empty string, and the hasValidToken() comparison logic cannot distinguish between “no token configured” and “attacker sent a matching empty token header.”