(This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated"). github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS authentication, the driver sends its initial GSS token and stores the provider, but it tracks neither whether a continuation occurred nor the provider's done result. The startup loop then accepts AuthenticationOk and completes the connection. The continuation branch also discards provider errors and can proceed after failed mutual authentication.