{"id":"TECH-202611-dmyizj","kind":"technique","aliases":[],"related":[],"title":"Humble Bundle's new website drops login 2FA and lets anyone already signed in change the password and email without the current password, making account takeover easy (users report, Humble silent)","description":null,"summary":"Since Humble Bundle launched its redesigned website on 11 Nov 2026, several users on SpaceBattles and r/humblebundles report, and say they checked themselves, that login no longer asks for a 2FA token (one user says the email code at login appears only sometimes), the password can be changed without the current password, and an email change is confirmed only by a code sent to the new address. The old address gets only an 'your e-mail was changed' notice with no link to Humble support. Users also say other changes (password, payment info, Steam link) send no email. So anyone with a reused or stolen password, or a stolen session, can lock the owner out and take the Steam keys, the library and any saved payment. Humble Bundle has not commented. No attacks reported yet. Unconfirmed: a user in a chat claims one-click payments are on for purchases.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Humble Bundle","fixed":[],"vendor":"Humble Bundle"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"You have a Humble Bundle account (humblebundle.com). Check whether login still asks for a 2FA code, whether your account email, password, linked Steam account and payment methods are unchanged, and look in your inbox for an unexpected 'your e-mail was changed' notice from Humble.","fix":"Give Humble Bundle a unique, strong password now, and change it anywhere else you used it. Remove saved payment methods, and unlink Steam if you don't need the link. Redeem or note any unredeemed keys. Watch for email-change notices, and if one arrives that you didn't ask for, contact Humble support (support.humblebundle.com). Consider deleting the account until Humble restores 2FA and re-confirmation.","status":"open","published_at":null,"first_seen_at":"2026-11-12T08:52:37+00:00","triaged_at":"2026-11-12T08:52:37+00:00","updated_at":"2026-11-12T08:54:00+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':33A '11':49B '2026':51B '2fa':8A,71B 'account':25A 'address':107B,110B 'alreadi':12A 'also':128B 'anyon':11A,141B 'appear':81B 'ask':68B 'attack':174B 'bundl':2A,43B,169B 'bundle':36A 'chang':15A,88B,96B,119B,131B 'chat':182B 'check':62B 'claim':183B 'click':186B 'code':78B,102B 'comment':172B 'confirm':98B 'current':22A,91B 'dmyizj':34A 'drop':6A 'e':116B 'e-mail':115B 'earli':38B 'early-warn':37B 'easi':27A 'email':19A,77B,95B,139B 'get':111B 'humbl':1A,30A,42B,125B,168B 'humble':35A 'info':134B 'key':161B 'launch':44B 'let':10A 'librari':163B 'link':123B,136B 'lock':153B 'login':7A,65B,80B 'longer':67B 'mail':117B 'make':24A 'new':4A,106B 'notic':120B 'nov':50B 'old':109B 'one':73B,185B 'one-click':184B 'owner':155B 'password':17A,23A,85B,92B,132B,147B 'payment':133B,167B,187B 'purchas':191B 'r/humblebundles':57B 'redesign':46B 'report':29A,58B,175B 'reus':144B 'save':166B 'say':60B,75B,129B 'send':137B 'sent':103B 'session':151B 'sever':52B 'sign':13A 'silent':31A 'sinc':41B 'sometim':83B 'spacebattl':55B 'steam':135B,160B 'stolen':146B,150B 'support':126B 'take':158B 'takeov':26A 'tech':32A 'techniqu':40B 'token':72B 'unconfirm':177B 'user':28A,53B,74B,127B,179B 'warn':39B 'websit':5A,47B 'without':20A,89B 'yet':176B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["bundle","humblebundle"],"ptokens":["bundle","humble"],"labels":["earlywarning","medium","technique","vendor"],"campaign_type":"other","search_a":"'-202611':33A '2fa':8A 'account':25A 'alreadi':12A 'anyon':11A 'bundl':2A 'bundle':36A 'chang':15A 'current':22A 'dmyizj':34A 'drop':6A 'easi':27A 'email':19A 'humbl':1A,30A 'humble':35A 'let':10A 'login':7A 'make':24A 'new':4A 'password':17A,23A 'report':29A 'sign':13A 'silent':31A 'takeov':26A 'tech':32A 'user':28A 'websit':5A 'without':20A","search_b":"'11':49B '2026':51B '2fa':71B 'address':107B,110B 'also':128B 'anyon':141B 'appear':81B 'ask':68B 'attack':174B 'bundl':43B,169B 'chang':88B,96B,119B,131B 'chat':182B 'check':62B 'claim':183B 'click':186B 'code':78B,102B 'comment':172B 'confirm':98B 'current':91B 'e':116B 'e-mail':115B 'earli':38B 'early-warn':37B 'email':77B,95B,139B 'get':111B 'humbl':42B,125B,168B 'info':134B 'key':161B 'launch':44B 'librari':163B 'link':123B,136B 'lock':153B 'login':65B,80B 'longer':67B 'mail':117B 'new':106B 'notic':120B 'nov':50B 'old':109B 'one':73B,185B 'one-click':184B 'owner':155B 'password':85B,92B,132B,147B 'payment':133B,167B,187B 'purchas':191B 'r/humblebundles':57B 'redesign':46B 'report':58B,175B 'reus':144B 'save':166B 'say':60B,75B,129B 'send':137B 'sent':103B 'session':151B 'sever':52B 'sinc':41B 'sometim':83B 'spacebattl':55B 'steam':135B,160B 'stolen':146B,150B 'support':126B 'take':158B 'techniqu':40B 'token':72B 'unconfirm':177B 'user':53B,74B,127B,179B 'warn':39B 'websit':47B 'without':89B 'yet':176B","search_c":"","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:56:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-dmyizj","url":"https://forums.spacebattles.com/threads/humble-bundle-just-completely-killed-most-of-their-security-through-vibecoding.1346295/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T08:52:37+00:00","fetched_at":"2026-11-12T08:52:37+00:00","note":null,"cites":["https://forums.spacebattles.com/threads/humble-bundle-just-completely-killed-most-of-their-security-through-vibecoding.1346295/"]}],"documents":[{"id":133313,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3n242nm6iuk26","title":"@campuscodi.risky.biz: Humble Bundle just completely killed most of their security through vibecoding \n","kind":"post","source":"bluesky","publisher":null,"text":"Humble Bundle just completely killed most of their security through vibecoding \n\nforums.spacebattles.com/threads/humb...\nhttps://forums.spacebattles.com/threads/humble-bundle-just-completely-killed-most-of-their-security-through-vibecoding.1346295/\n\nlikes 2 reposts 0","published_at":"2026-11-12T08:32:32+00:00","relation":"describes","confidence":null,"note":null},{"id":133331,"url":"https://forums.spacebattles.com/threads/humble-bundle-just-completely-killed-most-of-their-security-through-vibecoding.1346295/","title":"Humble Bundle just completely killed most of their security through vibecoding | SpaceBattles","kind":"blog","source":"analyst","publisher":null,"text":"Forum thread (11 Nov 2026): after Humble Bundle rolled out its new website, several users report and confirm for themselves that 2-factor authentication no longer asks for tokens at login (one user says email 2FA on login triggers inconsistently), the password can be changed without entering the current password or confirming, and email address changes are verified only by a code sent to the NEW address; the old address only gets an 'your e-mail was changed' notice with no Humble support link, but a link to an AI 'security' company. Users report no email notice for other account changes (password, payment info, Steam link). Humble Bundle has not commented. Linked Reddit thread: https://www.reddit.com/r/humblebundles/comments/1xtj3nj/2fa_removed_from_humble_bundle/","published_at":"2026-11-11T20:56:34+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}