My vikunja instance creates tasks with due date time of 9AM for tasks with the word 'today' word in it

That’s exactly what is happening. The demo is running on a server using utc+0 as timezone.

To fix this, we’d need to add another parameter “timezone” or something like that which we then pass to the query. Or we just always take the time zone from the user? (Ultimately that’s a design question, you won’t need to set your time zone manually when browsing the frontend)