PDAs are found, not generated, they aren't designed to be secretive.
let [pda, bump] = await PublicKey.findProgramAddress(
You don't need to know or "brute force" the bump. The
findProgramAddress method will start with bump = 255 and simply iterate down through bump = 254, bump = 253, etc. until it finds an address that is not on the elliptic curve.
can I generate the same pda and do some malicious transaction acting as authority for that pda
So you can find the PDA but it's entirely dependent on the program whether you can "do some malicious transaction".
Since only the owner of an account can modify it's data or debit lamports:
- The owning program will need to have an instruction to carry out those actions otherwise it won't be possible to do anything malicious
- You can't "act" as an authority. Only the "signing authority" (in this case the program) has the authority on that account.
If necessary checks are not in place on the program side, anyone "could" instruct the program to modify the data or debit the lamports from a PDA. (Considering instructions exist to do so)