HUMBLE BUNDLE · TECH-202611-dmyizj · Vendor
NO FIX YET · SEE WHAT TO DO
Since Humble Bundle launched its redesigned website on 11 Nov 2026, several users on SpaceBattles and r/humblebundles report, and say they checked themselves, that login no longer asks for a 2FA token (one user says the email code at login appears only sometimes), the password can be changed without the current password, and an email change is confirmed only by a code sent to the new address. The old address gets only an 'your e-mail was changed' notice with no link to Humble support. Users also say other changes (password, payment info, Steam link) send no email. So anyone with a reused or stolen password, or a stolen session, can lock the owner out and take the Steam keys, the library and any saved payment. Humble Bundle has not commented. No attacks reported yet. Unconfirmed: a user in a chat claims one-click payments are on for purchases.
first public Nov 11, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
your e-mail was changed notice from HumblePosts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.