Is this authentication system insecure or not
It is vulnerable to replay attacks since the attacker knows the plaintext and its corresponding ciphertext. To mitigate against this you might want to include some information in the message like a timestamp so that assuming time keeping isn't compromised for the server and client, outdated messages, i.e messages marked by a timestamp earlier than a certain timeframe can be invalidated.