It authenticates by checking that AP knows shared password. If that password is known by attackers, i.e. the network contains at least one malicious node, then that procedure is useless.