RESTAPI settings and login


Needing an api to access PHPLIST3 I install through plugin manager phpList REST API plugin v1

I can use it , But even with empty login and password i can access it!?

I can limit api’s access by IP, but is it normal process, that i can login to API with empty login and password.?