CVE-2023-40178

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale. This issue was patched in version 4.0.5.

• CWE-347
• CWE-613

• https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cecPatch
• https://github.com/node-saml/node-saml/releases/tag/v4.0.5Release Notes
• https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccwVendor Advisory
• https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cecPatch
• https://github.com/node-saml/node-saml/releases/tag/v4.0.5Release Notes
• https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccwVendor Advisory

Published

Aug 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40172Social media skeleton is an uncompleted/framework social med…8.8
• CVE-2023-40173Social media skeleton is an uncompleted/framework social med…7.5
• CVE-2023-40174Social media skeleton is an uncompleted/framework social med…9.8
• CVE-2023-40175Puma is a Ruby/Rack web server built for parallelism. Prior …9.8
• CVE-2023-40176XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2023-40177XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-40179Silverware Games is a premium social network where people ca…5.3
• CVE-2023-4018An issue has been discovered in GitLab affecting all version…5.3
• CVE-2023-40180 silverstripe-graphql is a package which serves Silverstripe…7.5
• CVE-2023-40181FreeRDP is a free implementation of the Remote Desktop Proto…9.1
• CVE-2023-40182Silverware Games is a premium social network where people ca…5.3
• CVE-2023-40183DataEase is an open source data visualization and analysis t…5.3