A flaw in the origin validation logic of the webauthn-rs-core and webauthn-authenticator-rs libraries allows an attacker-controlled domain to be incorrectly accepted as a valid origin for a relying party ID (RP ID) when subdomain origin allowance is enabled. This occurs because the check uses a simple string suffix match without verifying domain label boundaries, potentially enabling phishing attacks if the client implementation is non-conforming. The issue is fixed in versions 0.5.5 and 0.6.1-dev.