Humble Bundle Redesign Drops 2FA and Weakens Account Security: What Users Should Do

What changed​

Users on Reddit noticed first, and gaming publications quickly checked the claims. PC Gamer reported that the new site has no support for two-factor authentication whatsoever: users are unable to add it to their accounts, while those who had previously set it up on the old site design (including yours truly) are able to log in with just an email and password. The publication added that at no point in the login process does the site ask you to input a 2FA code.

Kotaku saw the same thing with its own account. Its reporter found that the choice to add or remove the feature is entirely missing under security settings.

The site's help content no longer matches the site. PC Gamer noted that Humble Bundle does not address the removal of 2FA anywhere on its new site. In fact, the site's FAQs still feature articles encouraging users to make use of it to keep their accounts secure, which is currently impossible.

Summary: Two newsrooms independently found that 2FA was missing from the new site. One of them confirmed that an account with 2FA turned on could still sign in with only an email address and password.

Password and email changes skip key checks​

The missing 2FA is the headline, but the account-change flows may matter even more. According to Kotaku, if logged in, you can simply enter a new password without having to know the current one. Kotaku says it also tested the email-change process. It found that verification went only to the newly entered address and never to the old one.

Aftermath summarized the issue this way: both missing features are standard security protocols to prevent someone from gaining unauthorized access to another person's account.

Here is why that matters. Suppose someone gets into a signed-in session, through a shared PC, a stolen laptop, a hijacked browser profile or session-stealing malware. Under the reported behavior, that person could:

1. Set a new password without knowing the current one.
2. Change the account email to an address they control, with the confirmation going only to their own inbox.
3. Keep the account after that, since the real owner would no longer have the password or receive account emails.

A missing check on the old password or the old email address is not a breach in itself. It does mean that one compromised session could turn into a full account takeover. These checks exist to stop exactly that.

Summary: The reported flows remove the safeguards that normally keep a temporary session compromise from becoming a permanent account loss.

What this does not show​

The reporting supports some claims and not others:

• Confirmed by multiple outlets: 2FA settings are missing, 2FA codes aren't requested at login, and password and email changes lack checks against the current password or old email address.
• Not established: any breach, unauthorized charge, stolen card data or confirmed account takeover. None of the reports document any of these.
• Unclear: whether the 2FA removal was intentional. PC Gamer said it reached out to Humble Bundle to ask if the change was intentional and if it will be reversed, and Kotaku says it also asked Humble for comment. When these reports were published, Humble and its parent company IGN had not responded publicly.

Some signs suggest the situation is changing. Aftermath noted that some Reddit users say the feature has since been re-enabled for them. Aftermath also reported that, according to updates on the Humble Bundle site, changes also include new checkout options and bundle pages, and login with a passcode instead of a password. One commenter on GamingOnLinux said some form of verification had come back as an emailed code rather than an authenticator-app code. That is a single user's account, not a confirmed fix. It's also unclear whether every account now has this protection or how it relates to the passcode login.

The "vibe-coded" accusation​

Many users have called the new site "vibe-coded," meaning built quickly with AI coding tools and little review. Kotaku's headline describes the redesign as "vibecoded-looking." Out of Games was more cautious, saying the vibe-coding claim is ENTIRELY speculation at the moment. Some GamingOnLinux commenters cited AI-style writing habits, such as frequent em dashes in error messages. That says something about the copy on the site, but it doesn't show how the code was written.

The more concrete background concerns staffing. Aftermath reported that owner Ziff Davis laid off a number of Humble's engineers over the summer, leading workers to fear exactly this sort of thing would happen. That doesn't prove the layoffs caused these bugs. It does make an understaffed release a more plausible explanation than an AI tool, which nobody has proven.

How the code was produced matters less than this: a storefront that may hold saved payment cards shipped without the account protections it used to have.

Other regressions​

The redesign also caused usability problems:

• Library sorting: Neowin reports that the claimed and unclaimed filters are gone and that the library search bar seems to be broken. Kotaku says users can no longer tell redeemed games and codes apart from unredeemed ones, which makes big libraries much harder to manage.
• Staying signed in: Kotaku reports there's also no way to remain logged in, forcing users to log in every time they access their library.
• Purchasing: People are reporting myriad other issues, including errors preventing them from purchasing new bundles. The reports don't say how widespread this is.

Many long-time Humble customers use their library as an archive of hundreds of unredeemed Steam keys. For them, losing the claimed/unclaimed filter makes the site much harder to use.

What Humble users should do now​

Humble has not published official guidance. Based on the reporting and standard account-security practice, these steps are sensible:

1. Try to remove saved payment methods. PC Gamer, Kotaku and Out of Games all recommend this until the security features are fixed. Be aware that PC Gamer says the inability to remove paiement method is concerning too, a complaint echoed by commenters. The removal option may be hard to find or may not work.
2. Make sure your Humble password is unique. If you have used it anywhere else, change it on those other sites as well. Without 2FA, a password leaked elsewhere is the most likely way into your Humble account.
3. Secure your email account. If the old email address is never contacted when the account email changes, your best early warning is a properly protected inbox, and your main mailbox should have 2FA turned on.
4. Sign out on shared or public PCs. The reported flaws matter most when someone else can reach a session where you're already signed in.
5. Check your purchase history and email for receipts or account-change notices you don't recognize.
6. Check whether 2FA has come back for your account, since some users say it has been re-enabled. Don't assume it's working until the login prompt actually asks for a code.

Changing your Humble password won't make up for missing 2FA or weak account-change checks. These steps lower your risk while Humble fixes the site.

Analysis​

From an IT security perspective, the question is why nobody caught this before launch. When an existing platform gets a redesign, the old security controls are a baseline for the new one. These include re-entering your password before changing credentials, verifying with the old address before an email change, and honoring 2FA for accounts that already have it turned on. A basic regression test should catch these. The help pages still tell users to turn on 2FA, which suggests the content team and engineering team weren't working from the same list of features.

For enterprise administrators, this is a reminder that consumer accounts on work machines carry their own risk. A hijacked browser session on a shared workstation can now lead to more on Humble than it could before the redesign.

The fairest reading of the evidence is that this looks like a rushed rollout, not a deliberate decision to weaken security, and some protections may already be coming back. Until Humble explains what happened and confirms a full fix, users should assume their Humble account has fewer protections than it did before the redesign.