I have always been told that writing your own login method (e.g. validate user given the username and password) is bad practice, and that one should reuse existing libraries for that. I have always believed that, but I am looking for practical threats in such a scenario (C#). The practical case I am looking into is customizing a login method to include the validation of a Captcha. I haven't found any existing library to do that inside the authentication logic.
One of the implications of my custom implementation is that the validation method does not return a bool, but another type. May this pose a danger?