Security: Authentication token and webhook secrets exposed via command-line arguments #5

New issue

Closed

opened 2026-05-09 05:18:41 +00:00 by Mark · 1 comment

Mark commented

2026-05-09 05:18:41 +00:00

Owner

Severity: Medium

Both the auth token and webhook secrets are passed as CLI arguments, making them visible to any user who can run ps aux or inspect /proc/ at the moment the command is running.

Locations:

auth_commands.py:18-19: --api-url and --token for auth login
project_commands.py:136: --secret for webhook creation

Impact:

On multi-user systems, other users can see the token/secret in the process list
Command-line arguments are logged by shell history

Fix:

For auth login, read the token from stdin or a file descriptor instead of a CLI flag
For webhooks, accept --secret from a file or env var, or mask in help text
Alternatively, add a warning to the docs about this exposure

Example of the problem:

# Any other user running `ps aux | grep vikunja` sees:
vikunja auth login --api-url https://example.com --token my-secret-token-here
vikunja project webhooks create 1 https://hook.example.com task/create --secret my-webhook-secret

**Severity: Medium** Both the auth token and webhook secrets are passed as CLI arguments, making them visible to any user who can run `ps aux` or inspect `/proc/` at the moment the command is running. **Locations:** - `auth_commands.py:18-19`: `--api-url` and `--token` for `auth login` - `project_commands.py:136`: `--secret` for webhook creation **Impact:** - On multi-user systems, other users can see the token/secret in the process list - Command-line arguments are logged by shell history **Fix:** - For `auth login`, read the token from stdin or a file descriptor instead of a CLI flag - For webhooks, accept `--secret` from a file or env var, or mask in help text - Alternatively, add a warning to the docs about this exposure **Example of the problem:** ```bash # Any other user running `ps aux | grep vikunja` sees: vikunja auth login --api-url https://example.com --token my-secret-token-here vikunja project webhooks create 1 https://hook.example.com task/create --secret my-webhook-secret ```

Mark commented

2026-05-12 02:10:43 +00:00

Author

Owner

Fixed in commit. Closing.