OpenPanel is a web hosting control panel. It manages users, domains, databases, files, email, DNS, and server administration through a browser interface and an API. A count of 22 application fingerprints is small, but each match could represent a broad control plane rather than a single application account.
On November 2, 2026, a ZoomEye SDK count-only query returned 22 matches for app="OpenPanel" and 281 for title="OpenPanel" with sub_type=all, page 1, and a page size of 1. The application fingerprint is more specific. The title count includes pages that mention the product, documentation, or a customized interface.
OpenPanel's OpenAdmin API documentation says all endpoints require Bearer JWT authentication. It also states that the API runs with the same privilege as the admin panel and that tokens must be scoped and rotated accordingly. A reseller token is described as limited to the reseller's users, domains, and email accounts. Per-account permission overrides can be reset to plan defaults.
Those statements suggest a review that starts with identity type:
Super administrator or root-level OpenAdmin access.
Reseller access and its downstream users.
End-user panel accounts and their enabled features.
API tokens, MCP tokens, and automation credentials.
Direct database, file-manager, DNS, and email management paths.
For each token, record the owner, scope, creation time, last use, and revocation path. Test a reseller token against another reseller's user and domain. Test an end-user token against an administrative endpoint. Confirm that removing a permission override takes effect without requiring a full account reset. Check whether API access can be disabled server-wide and whether the operation is visible in logs.
The interface can also expose credentials indirectly. File-manager access may reveal application configuration. Database management may bypass application authorization. Email management may allow mailbox resets. DNS management can redirect traffic or issue certificates. A user who can only manage one site still has a meaningful control plane over that site, and a reseller account may have the same power over many sites.
The 22 application matches are a useful external inventory signal but not proof that every instance is reachable or unsecured. The review should confirm ownership, then test the smallest account that should have access. A successful login test is less useful than a negative test with a token or account from the wrong tenant.
OpenPanel's concentration of server authority makes it a high-value target. The useful metric is not the number of pages. It is the number of tokens and user roles that can reach a server-wide action.
Query evidence
app="OpenPanel" returned 22 matches. title="OpenPanel" returned 281. Both queries used sub_type=all, page 1, and a page size of 1.