Zoho ManageEngine DesktopCentral version 10.1.2119.7 and prior allows anyone to get a valid user's APIKEY without authentication.
Published September 10, 2021.
Zohocorp Manageengine Desktop Central