How to filter/hook-into retrieve_password() to filter $_POST[‘user_login’]?

Is this something that could work for you?

/**
* Hooks before login and filters out the CPF mask if it exists
*/
add_action( 'wp_authenticate' , 'somos_filter_username' );
function somos_filter_username() {
  $cpf = preg_replace('/[^0-9]/is', '', $_POST['user_login']);
  if (is_valid_cpf($cpf)) {
    return $cpf;
  }
}