SecurityFriday, November 13, 2026

Humble Bundle's Redesign Dropped 2FA, and Two Other Missing Checks Make It Worse

Updated November 14, 2026 at 4:26 PM

Consumer Security
Explainer
Gaming
Passwords

Humble Bundle's Redesign Dropped 2FA, and Two Other Missing Checks Make It Worse — Uploaded by the desk

Humble Bundle's redesigned website no longer lets customers manage two-factor authentication, and users who had it switched on report that it is no longer asked for at sign-in. Two other missing checks matter just as much. Here is what Humble's own documentation says should happen, what reporters found instead, and what account holders can do while the company stays silent.

Updated November 13, 2026, 9:00 a.m. New York time (EST).

Humble Bundle, the game and ebook storefront owned by IGN, has shipped a redesign that removed the settings for two-factor authentication (2FA), the second check that stops someone who has your password from getting into your account. PC Gamer's Joshua Wolens, who had set up 2FA on the old site, reported on November 12 that he can now sign in with just an email address and password: "At no point in the login process does the site ask you to input a 2FA code." Kotaku and The Verge confirmed that the option to add or change 2FA is gone from account settings.

The missing 2FA prompt got the headlines. But the more serious problem is a combination: Kotaku also found that a signed-in user can set a new password without entering the current one, and that changing the account's email address sends a notice only to the new address. Each gap is bad on its own. Together they are what turns a brief intrusion into a permanent account takeover. As of Friday morning, Humble had not explained any of it.

What changed, and what Humble's own help pages say

Humble's support documentation describes two layers of sign-in protection, and the redesign appears to have broken the relationship between them.

Two-Step Verification is Humble's optional 2FA. According to its help article, after your email and password you are "asked for a token that is generated through Google Authenticator", a short-lived code from an authenticator app on your phone. The same page says that enabling it "will replace the Browser Verification method - Humble Guard."
Browser Verification, or Humble Guard, is the default for everyone else. Humble's documentation says that when "a new web browser is used for the first time" to log in, redeem a key or change account details, you "may" be prompted for a code sent to your email. It "cannot be disabled", and the page adds: "You must use either Browser Verification or 2-Step Verification to secure your account."

That second document helps explain why reports have been contradictory. The Verge's Jay Peters wrote that when he logged in he was "prompted to check my email for an access code", but he was never asked for the authenticator code he had set up for the site. Some users on X described the same thing. Others, like PC Gamer's reporter, saw no prompt at all.

An email code at login is what Humble's documentation says accounts without app-based 2FA receive. So the reports are consistent with authenticator-app users being moved back to the email-code tier, and with that check only firing on browsers the site does not recognize, which would explain why some people saw no prompt. That is our reading of Humble's documentation alongside the reporters' tests, not something Humble has confirmed. Either way, the stronger option that customers chose has stopped working.

Why an email code is not the same protection

An email code does something. Someone who bought your Humble password from a breach list still needs to get into your inbox. But it moves the whole defense onto your email account, and the U.S. National Institute of Standards and Technology, whose digital identity guidelines are the reference for this kind of design, is blunt about the weakness. Its authenticator guidance says email "SHALL NOT be used for out-of-band authentication" because it may be vulnerable to "access using only a password", interception at mail servers and rerouting attacks.

The first of those is the everyday risk. People who reuse passwords often reuse the same one, or a near copy, on their email. An authenticator app breaks that chain, because the code lives on a phone the attacker does not have. An emailed code doesn't.

The real problem: three gaps that line up

Passwords are not the only way into an account. Malware that steals browser data, known as an infostealer, can lift the session cookie that keeps you logged in. With that cookie an attacker skips the login page entirely, so no 2FA or email code is ever asked for. Sites defend against this by asking you to prove who you are again before the changes that matter most. Kotaku's testing suggests the new Humble site doesn't do that for two of them.

Password change without the current password. Kotaku and The Verge both report that a signed-in session can set a new password without knowing the old one. The OWASP Foundation's widely used Authentication Cheat Sheet lists current-password verification as a basic control for exactly this case: "a user logs in on a public computer and forgets to log out," and "another person could then use that active session."
Email change with no warning to the old address. Kotaku found that changing the account email sends information only to the new address. Humble's own help page describes the opposite: accounts without 2FA may be asked for a verification code to complete the change, and that code "should be sent to your current registered email address, not the address you are changing to."
No working app-based 2FA to fall back on, as described above.

Put together: someone who gets into a live session, through a stolen cookie or a shared or public computer left signed in, could change the password, then point the account at their own email. If Humble Guard now sends codes to the account's registered address, that address would by then be the attacker's. The rightful owner is left without a password, without the recovery email and without an authenticator to prove they own the account. Recovery would then depend on Humble's support team.

We have not tested this sequence ourselves, and there are no public reports of it being used against Humble customers. It follows directly from the behavior the three outlets describe, and it's the reason those checks exist on almost every major account system.

What is actually at stake

A Humble account is worth more than it looks. Accounts can have payment details saved for bundle purchases and Humble Choice subscriptions, which is why PC Gamer and Kotaku both suggested removing saved payment details for now. PC Gamer quoted users saying they could not find how to do that on the new site.

The larger prize for many long-time buyers is their library of unredeemed game keys. Humble's own Browser Verification page says the feature exists to protect accounts "from the game keys being redeemed or account changes being made without the consent of the account owner." A Steam key can be activated only once, by whoever enters it first. Users quoted by Kotaku also say the new library no longer separates redeemed from unredeemed keys, which would make it harder for owners to notice if any had gone.

Was the site "vibe-coded"?

Kotaku's headline called the redesign "vibecoded-looking," and the phrase has followed the story across X, where some of the most-shared posts accuse Humble of shipping AI-generated code. There is no public evidence about how the new site was built, and Humble hasn't said.

The question matters less than it seems. Security checks like re-authentication and old-address notices often live in an old system's code rather than in anyone's specification. When a front end is rebuilt, by people or with AI tools, controls that were never written down as requirements and tested are easy to lose without anyone noticing. Whatever tools were used, the gaps reporters found are the kind a pre-launch security review of account settings is meant to catch.

What Humble users should do now

Make your Humble password unique. If it is used anywhere else, change it. While the site relies on password plus, at most, an email code, a reused password is the easiest way in.
Lock down the email account behind it. Your inbox now carries the weight that your authenticator app used to. Give it a unique password and app-based 2FA or a passkey.
Remove saved payment methods if you can find the option, and check your card statement for Humble charges you don't recognize.
Claim the keys you care about. Redeeming a key to your own Steam or other platform account takes it out of reach of anyone who later gets into your Humble account.
Log out on shared computers and treat any unexpected Humble email, especially about a changed address, as urgent. Contact Humble support straight away.
Keep your Humble entry in your authenticator app. If the feature comes back, you may need it.

What to watch

The test now is whether Humble restores app-based 2FA and re-authentication, and whether it explains what happened during the gap. Customers would need to know whether authenticator settings survived or must be set up again, and whether any accounts saw password or email changes while the checks were missing. Kotaku and PC Gamer have asked Humble for comment. As of Friday morning, New York time, neither had reported a reply, and the company's X account had posted a steady stream of Black Friday sale promotions but no statement.