---
id: "TECH-202611-dmyizj"
page: "https://infrastack.ai/live/TECH-202611-dmyizj"
kind: "technique"
aliases: []
title: "Humble Bundle's new website drops login 2FA and lets anyone already signed in change the password and email without the current password, making account takeover easy (users report, Humble silent)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Humble Bundle", "fixed": [], "vendor": "Humble Bundle"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-12T08:52:37+00:00"
updated_at: "2026-11-12T08:54:00+00:00"
sources: [{"source": "analyst", "url": "https://forums.spacebattles.com/threads/humble-bundle-just-completely-killed-most-of-their-security-through-vibecoding.1346295/", "first_seen_at": "2026-11-12T08:52:37+00:00", "cites": ["https://forums.spacebattles.com/threads/humble-bundle-just-completely-killed-most-of-their-security-through-vibecoding.1346295/"]}]
exploit_sources: []
---

# Humble Bundle's new website drops login 2FA and lets anyone already signed in change the password and email without the current password, making account takeover easy (users report, Humble silent)

Link for people: https://infrastack.ai/live/TECH-202611-dmyizj (this .md is for agents)

Since Humble Bundle launched its redesigned website on 11 Nov 2026, several users on SpaceBattles and r/humblebundles report, and say they checked themselves, that login no longer asks for a 2FA token (one user says the email code at login appears only sometimes), the password can be changed without the current password, and an email change is confirmed only by a code sent to the new address. The old address gets only an 'your e-mail was changed' notice with no link to Humble support. Users also say other changes (password, payment info, Steam link) send no email. So anyone with a reused or stolen password, or a stolen session, can lock the owner out and take the Steam keys, the library and any saved payment. Humble Bundle has not commented. No attacks reported yet. Unconfirmed: a user in a chat claims one-click payments are on for purchases.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Humble Bundle affected range not listed fixed no fixed version listed

## How to check

You have a Humble Bundle account (humblebundle.com). Check whether login still asks for a 2FA code, whether your account email, password, linked Steam account and payment methods are unchanged, and look in your inbox for an unexpected 'your e-mail was changed' notice from Humble.

## Fix

Give Humble Bundle a unique, strong password now, and change it anywhere else you used it. Remove saved payment methods, and unlink Steam if you don't need the link. Redeem or note any unredeemed keys. Watch for email-change notices, and if one arrives that you didn't ask for, contact Humble support (support.humblebundle.com). Consider deleting the account until Humble restores 2FA and re-confirmation.

## Timeline

- 2026-11-12T08:52:37+00:00 analyst https://forums.spacebattles.com/threads/humble-bundle-just-completely-killed-most-of-their-security-through-vibecoding.1346295/

## Documents

- [describes] @campuscodi.risky.biz: Humble Bundle just completely killed most of their security through vibecoding 
 https://bsky.app/profile/campuscodi.risky.biz/post/3n242nm6iuk26
- [describes] Humble Bundle just completely killed most of their security through vibecoding | SpaceBattles https://forums.spacebattles.com/threads/humble-bundle-just-completely-killed-most-of-their-security-through-vibecoding.1346295/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_