Humble Bundle's New Vibe-Coded Storefront Deleted 2FA and Never Asks for Your Old Password

By CriticalPixel · 2026-11-12

A Storefront Rebuild That Forgot the Lock

Humble Bundle tore down its storefront this week and put up a new one in a hurry, and somewhere in that rush the two-factor authentication switch vanished. Users flagged it within hours of the November 11 relaunch. Kotaku then logged into its own account, opened the security settings, and found the option to turn 2FA on or off simply gone from the page. For a shop that stores saved cards and years of key purchases, that is not a cosmetic bug. That is the front door hanging off one hinge, with a note taped to it saying everything is fine.

The bigger problem sits one page over. That same test found the password change form no longer asks for your current password. You are logged in, you type a new one, the site accepts it, and the old password never enters the conversation. Changing your email address is just as loose. No verification message goes to the old inbox, so the only confirmation lands on the address you just typed in. Anyone holding a live session can take the account and lock the owner out of it, and the owner gets no warning sent to the address that used to be theirs.

Screenshot of the rebuilt Humble Bundle checkout combining bundles and store items in one cart

None of this arrived with a warning. The new homepage greets visitors with a cheerful banner that reads 'Welcome to the new Humble Bundle!' and a button offering to show what changed. The changelog talks about a combined checkout and a fresh look. It does not mention that account security got lighter. Kotaku asked Humble for comment and had no public answer when the story went up, and there is still no notice on the storefront telling customers to check their settings.

No Old Password, No Email Check, No Second Factor

Think about what an attacker actually needs here. Not a password reset email, not a stolen recovery code, just an open session on a shared laptop, a stale tab on a family PC, or a password reused from some other breach. With that, the account is theirs. They can set a new password, point the email at their own inbox, and the real owner cannot recover it through the normal flow, because the normal flow no longer verifies the old address. Two-factor authentication was the thing that made that scenario annoying instead of trivial, and it is not there anymore.

Humble Bundle has spent fifteen years selling games for charity, and IGN owns the company outright. The pitch has always been simple: pay what you want, send part of it to a cause, walk away with Steam keys. That model depends on people trusting the account page enough to leave a card on file. Humble Choice still runs $14.99 a month on the new store, and the November lineup leads with The Outer Worlds 2 and Mafia: The Old Country. Good games, familiar prices, and an account system that no longer answers the one question that matters.

The storefront itself is still running and still selling. Humble Bundle's own homepage lists the November Choice bundle at $14.99, pushes a combined cart for bundles and store items, and advertises guest checkout with no sign up required. That last part is worth a beat. The site is happy to take a payment from someone with no account, and the accounts it does keep are missing the second lock. Fast checkout and slow security is a bad trade for a store whose customers are mostly repeat buyers with libraries built over years.

The Rest of the Site Is Just as Raw

The security holes are not the only rough edges. Users say the rebuilt library no longer separates redeemed keys from unclaimed ones, which turns a long purchase history into a wall of identical tiles. Others report getting logged out on every visit, so opening your library means logging in again first. Some cannot complete a purchase at all. A developer on Bluesky described failing to buy a bundle with internal errors on every attempt, hours before the security story broke. A storefront that cannot reliably take money while it cannot reliably protect the money it already took is having a very bad week.

Humble Choice key art for November featuring The Outer Worlds 2 and Mafia The Old Country

Players Are Already Pulling Their Cards

The reaction has been loud and specific. A Bluesky post from ButtercupBandito warning people to remove saved payment information before it is too late picked up more than 1,000 reposts and over 1,300 likes by mid morning, with 35 replies and 111 quote posts. The replies are full of people opening their own settings and finding the same empty space where 2FA used to be. Privacy accounts jumped in to say they tested it and it held. Nobody is arguing about the color palette. They are arguing about whether their card details are sitting behind a login that no longer has a second step.

Hacker News pushed it past the gaming crowd. The thread hit 287 points and 168 comments, and most of it was developers arguing about whether an AI assisted rebuild can be trusted with authentication at all. One of the top comments put it flatly: 'You do not code your authentication system, in 99% of cases.' Another asked how anyone compares an old site with a new one and misses two-factor authentication. That is the part that stings. This was not a subtle regression buried in a settings submenu that nobody opens.

Kenney, the indie developer behind a small empire of free game assets and tools, summed it up on X. Humble 'forgot' to add 2FA, he wrote, so it is now removed from your account, and you can change your password without entering the previous one 'because what even is security'. The post did not need a thread or a graphic. It landed with the people who actually sell games through Humble, and those are the people who know what an account takeover does to a small studio's payout history.

What Humble Owes Its Customers Now

My read is that this started as a design refresh and got promoted to a platform migration without anyone writing the checklist. Two-factor authentication is not a premium feature. It is the minimum for anything holding a payment method, and Humble has held payment methods for fifteen years. A rebuild that drops it should never have cleared review, let alone gone to production on a Tuesday. The password reset flow skipping the current password is worse, because it turns any stolen session into a permanent takeover with no recovery path.

Until Humble ships a fix, treat the account as exposed. Delete saved payment methods. Change the password to something long and unique, from a device you trust. If you reused that password anywhere else, change it there too. Check your purchase history for anything you did not buy, and watch your inbox for password or address change notices you did not trigger. Then check again in a week, because a rushed fix on a rushed rebuild is not a guarantee.

The new site says 'a new look, same Humble you know and love.' What it currently offers is a new look, a broken library, and a login with the safety rails pulled out. Humble can fix this quickly: restore two-factor authentication, require the current password before any change, and send confirmation to the old email address before anything moves. Until that happens, the responsible move for every customer is to assume the account is one open tab away from someone else's hands.