Zoho ManageEngine OpManager prior to 125120 allows an unauthenticated user to retrieve an API key via a servlet call.
zohocorp manageengine opmanager 12.5