--- a/sys/netproto/802_11/wlan/ieee80211_hostap.c
+++ b/sys/netproto/802_11/wlan/ieee80211_hostap.c
@@ -878,6 +878,29 @@
 			wh = mtod(m, struct ieee80211_frame *);
 			wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
 		}
+		else if (subtype == IEEE80211_FC0_SUBTYPE_AUTH &&
+		    m->m_pkthdr.len >= sizeof(struct ieee80211_frame) + 6 &&
+		    m->m_len >= sizeof(struct ieee80211_frame) + 6) {
+			/*
+			 * 802.11-2016 12.3.3: the shared key authentication
+			 * response (frame 3) must be encrypted.  The AP sends
+			 * the challenge text in the clear, so accepting a
+			 * clear text response lets anyone who can hear the
+			 * challenge complete the exchange without the key.
+			 */
+			const uint8_t *af = (const uint8_t *)wh + sizeof(*wh);
+			if (le16toh(*(const uint16_t *)af) ==
+				IEEE80211_AUTH_ALG_SHARED &&
+			    le16toh(*(const uint16_t *)(af + 2)) ==
+				IEEE80211_AUTH_SHARED_RESPONSE) {
+				IEEE80211_DISCARD(vap,
+				    IEEE80211_MSG_AUTH | IEEE80211_MSG_INPUT,
+				    wh, "auth", "%s",
+				    "shared key auth response not encrypted");
+				vap->iv_stats.is_rx_bad_auth++;
+				goto out;
+			}
+		}
 		/*
 		 * Pass the packet to radiotap before calling iv_recv_mgmt().
 		 * Otherwise iv_recv_mgmt() might pass another packet to