cyber.hendryadrian.com
Security News · privacyaffairs.com

Humble Bundle Relaunches Website Without Two-Factor Login

· Original article ↗

Summary

PrivacyAffairs reports that Humble Bundle’s relaunched site no longer offers a second login step: password, emailed code and Google sign-in are alternatives. The author verified password-only access; Humble has not publicly commented.

Key points

  • The author reports testing the relaunched site on November 12, 2026: a password alone allowed sign-in, and account settings offered no way to require a second factor.
  • An emailed code and Google sign-in are alternative login methods, not a second step after a password; access to the account’s email can also enable sign-in.
  • The article says the site uses Ory, which supports second-factor options, but reports that Humble has not enabled them.
  • Settings-page code still contains text for Two-Step Verification options, including Google Authenticator and SMS (Authy); the article says this may indicate the feature was left out of the launch, but Humble has not confirmed its plans.
  • Unredeemed game keys may be at risk if an account is accessed; Humble reportedly cannot replace keys from purchases more than 14 days old.
  • The article recommends using a unique password, securing the associated email account with two-factor authentication, and redeeming saved game keys.

Article Details

Event Type
Humble Bundle's relaunched website no longer offers two-factor login as a second step.
Impact
The article reports that a password alone, or an emailed sign-in code, can provide access to an account; users cannot require both factors. This may expose unredeemed game keys and saved payment or subscription details to unauthorized access. No account compromise is reported, and Humble says it cannot replace keys from purchases older than 14 days.

People

Jason HallThe article identifies Hall as the game developer who runs the Pirate Software account on X, which warned that two-factor authentication was absent from Humble Bundle's login flow and settings.

Vendors

OryThe new sign-in runs on auth.humblebundle.com, and the site’s public code shows it uses Ory, a third-party login service.

Products

Google AuthenticatorUntil the relaunch, Humble offered what it calls Two-Step Verification: after your password, the site asked for a code from Google Authenticator.Humble BundleHumble Bundle’s new website has no two-factor login.Humble GuardAccounts without it still had Humble Guard, a code sent by email whenever you logged in from a new browser or device.