ZoomEye Scan Finds Tens of Thousands of Exposed Media Request Apps, Mostly Unsigned

A security analysis of the ZoomEye index counted roughly 8,900 hosts with Overseerr page titles and about 42,800 with Ombi titles as of late October 2026. Most matching assets responded on port 443 behind reverse proxies rather than on each product's default port. Neither product has an application fingerprint, so the counts rely on title matching, which can produce false positives from longer words containing the search string. The author warns these apps hold API keys to other media services and are often exposed via directly published container ports that bypass proxy authentication. The findings suggest the category is large yet largely absent from product-based asset inventories.