Vikunja 1.1.0 is out!
Includes a security fix! Also: 
S3 signing config, webhook Basic Auth, smarter date parsing & more fixes.
Upgrade highly recommended!
Check out the full release post here: Vikunja 1.1.0: One Security fix, bugfixes, a few new features