Humble Bundle’s redesigned website has raised security concerns after users discovered that two-factor authentication controls are missing. The updated account settings no longer offer an option to add or manage authenticator-based verification.
The Humble Bundle two-factor authentication changes were reported on November 12, 2026. Some users can still receive email verification codes, but previously configured authenticator apps are reportedly no longer required.
Humble Bundle Two-Factor Authentication Settings Disappear
Humble Bundle previously let customers secure accounts with rotating codes generated by authenticator apps.
Following the redesign, users reported that these settings had disappeared. PC Gamer confirmed that during its login test, users were not prompted for previously configured authenticator codes.
Humble Bundle’s support documentation still discusses two-step verification, creating confusion about which security methods remain available.
Some users reported receiving email access codes during sign-in. However, an emailed login code does not necessarily provide the same protection as a separate authentication factor.
Password Changes Raise Additional Security Concerns
The redesign also prompted questions about password and account management.
According to Kotaku’s investigation, logged-in users could change passwords without entering their existing password.
The publication also reported problems with changing email addresses and accessing saved payment information.
These issues could increase the risk of account takeover if an unauthorized person gains access to an active session.
TechAmerica previously examined human verification technology and why sensitive account changes may require additional authorization.
Why Missing Two-Factor Authentication Matters
Humble Bundle accounts can contain purchased games, unused activation keys, subscription details and saved payment methods.
Two-factor authentication adds protection when passwords are stolen or exposed. Authenticator apps generate temporary codes that help prevent unauthorized account access.
Removing these controls could weaken security, particularly for customers who reuse passwords across services.
TechAmerica’s coverage of hardware-backed authentication and passkeys explains how stronger login methods reduce the risk of credential theft.
What Humble Bundle Users Should Do
Customers should review their account settings and confirm which login protections are currently available.
Using a unique password, securing the associated email account and reviewing saved payment methods can reduce potential exposure.
Users should also check their purchase history and unused game keys for unexpected activity.
Humble Bundle, owned by IGN Entertainment under Ziff Davis, had not publicly explained the missing settings in the initial reporting.
It remains unclear whether the changes are permanent or will be corrected in a future update.
