Science & Tech · Cybersecurity · 53 mins ago
Humble Bundle redesign removes two-factor authentication
Humble Bundle, a digital store for games, books and software, has launched a redesigned website that no longer supports two-factor authentication.
Users who had enabled it can now log in with only an email address and password, while new users cannot turn it on.
The update also appears to let logged-in users change passwords without entering their current one, and change email addresses without verification to the old address.
These changes could make it easier for someone to take over an account, which may contain saved payment information.
Users have also reported trouble buying bundles and managing game libraries.
Until the issues are resolved, users are advised to remove payment details from their accounts, though some say they have trouble doing so.
Humble Bundle has been asked to comment, but no response or fix is reported.
Humble Bundle’s redesigned website removed support for two-factor authentication, according to reports by PC Gamer and Kotaku.
Users who had enabled the feature can reportedly log in with only an email address and password.
Kotaku also reported missing checks when changing passwords or email addresses, which could put accounts and saved payment information at risk.
Users reported other problems, including difficulty finding unredeemed games and errors when purchasing bundles.
Humble Bundle had not commented in the articles, and the reason for the changes was not stated.
- Who
- Humble Bundle users and the Humble Bundle storefront.
- What
- The redesigned site reportedly removed two-factor authentication and other account security checks.
- When
- The redesign was reported on November 12, 2026.
- Where
- On Humble Bundle’s website.
- Why
- Not stated.
This story does not have two clearly opposing sides.
Some Humble Bundle users had enabled two-factor authentication on the old site.
Users reported that two-factor authentication was unavailable and that the site lacked other security checks.
PC Gamer and Kotaku reported on the security concerns and other problems with the redesign.
- Authentication
- Two-factor authentication was unavailable on the redesigned site
- Password changes
- Kotaku reported users could change passwords without entering their current password
- Email changes
- Kotaku reported that verification was not sent to the old email address
- Payment information
- The articles warned that saved credit card information could be at risk
- Reporting date
- November 12, 2026
2 sources
What people are saying
This is insanely bad, they need to take down password changes entirely until this is fixed
I can't even see a way to remove saved payment details anymore, this is seriously dangerous and the site should be taken offline until fixed ASAP