To the surprise of many, a new redesign arrived for the Humble Bundle website yesterday, aiming to offer a bit more of a modern design over the previous version. However, it didn’t take long for people to discover that this redesign also introduced a slew of security issues.
After reading through comments on on one r/humblebundles post, here are just some of the problems:
- Users no longer prompted for 2FA
- Change password without needing to enter previous password
- Wishlist no longer appears
- Dropped max password length to 72 characters, some users unable to login
- No way to delete your account or payment methods
- Unable to delete payment method but keep subscription
On X, @PirateSoftware shared the security problems above, while also adding one more: “Changing your email works the same way. It asks for a verification code on the NEW email not the old one. This lets the attacker swap your email out without a single barrier. It doesn’t even send an alert to the original email until after the account is tied to the new email.“
The overarching assumption seems to be that this new site design for Humble Bundle has been vibecoded, but half-assedly. While the site seems to function normally, it’s resulted in a security nightmare and one that doesn’t yet seem to be fixed at the time of this writing.
If this seems as though someone is asleep at the wheel, there’s definitely some validity to that argument. As pointed out on Bluesky, “six members of the engineering team that works on IGN.com and Humble Bundle” were laid off earlier this year. IGN and Humble Bundle are both owned by Ziff Davis, with a former employee stating they “watched them slowly lay off most of their engineers and backend folks.”
Since these vulnerabilities were discovered, many have tried to either remove their payment methods or delete their Humble accounts entirely. Unfortunately (and unsurprisingly), it’s not currently possible to do so from the site directly. Instead, you’ll need to head over to the Humble Bundle Privacy Portal and request your account deletion.
We really hope that the site redesign doesn’t result in a security breach that hasn’t yet been disclosed. We’re also hoping that Humble is able to rectify the issues being faced by its customers, but even for as great as the site has been over the years, this is a pretty ugly situation.
