Recaptcha issues after google introduced reCAPTCHA Mobile Verification

[AdamMalina]

Current Behavior

Hello,
I'm not sure if I'm submitting it properly. This issue is somewhere between bug report, feature request and security issue (not a vulnerability report).

Google recently introduced reCAPTCHA Mobile Verification, which requires scanning a QR code with a smartphone even if you use a PC. This means that people logging into pterodactyl panel (with recaptcha configured) can be asked to take their smartphone and scan the QR code. This is not possible in many cases such as person not having a smartphone (completely or with them, eg. forgotten/lost), person having a non-compatible smartphone (eg. outdated OS, custom ROM/degoogled phone, not having Apple ID account), smartphone being completely discharged, etc...

That may prevent some of our users from signing in to the pterodactyl panel we host. It can even be an issue in case on emergency, eg. someone's account got hacked (and every second matters) and administrator can't quickly sign in, because they have to get their smartphone, open some app and scan the QR code.

The only workaround is disabling the recaptcha completely (assuming you can login to the panel), however that is not recommended by Pterodactyl docs as it decreases the security (allows brute-force attacks). Allowing to switch to a different captcha provider will fix this issue.

As I mentioned earlier, I'm not sure if it's a bug report or a feature request, because it falls somewhere in the middle. If you decide it's a feature request, feel free to close it and I will repost it as a feature request. I decided to post it here only because the only known workaround impacts the security of the panel.

Expected Behavior

Being able to sign in to pterodactyl with just PC/laptop, without needing to have a smartphone.

Steps to Reproduce

1. Have recaptcha enabled.
2. Be requested by google to pass reCAPTCHA Mobile Verification, which is random and it's not known what factors are being taken into account.

Panel Version

1.12.2

Wings Version

1.12.1

Games and/or Eggs Affected

No response

Docker Image

No response

Error Logs

Is there an existing issue for this?

• I have searched the existing issues before opening this issue. I understand that maintainers may close this issue without communication if I have not provided sufficient information.

[stijnwtf]

We ran into the same issue and agreed that Google's new mobile verification flow can create accessibility and availability problems for some users.

In our fork we've implemented support for alternative CAPTCHA providers, which removes the dependency on Google's mobile verification requirement while still allowing administrators to protect against automated login attempts.

We're also actively working on fixing additional long-standing issues and adding new features that aren't currently available upstream.

If anyone is interested in testing the implementation or providing feedback, the project is available here:
https://github.com/realmopensource