Twitch Browser Extension Exposes User OAuth Tokens to Third-Party Service

A browser extension with more than 30,000 installs is transmitting users’ Twitch OAuth session tokens to a commercial bot service, posing a significant risk of account takeover.

Researchers at Socket discovered that the extension, known as Twitch Enhanced Viewer | JeetBot, is available in the official Chrome and Firefox stores. While advertised as a tool to block ads, bypass region restrictions, and enable 1080p playback, the extension captures the authorisation header used by the Twitch web client to extract user credentials.

Technical mechanism of the exposure

The extension directs Twitch video playlist requests through proxy servers operated by JeetBot, a Russian-language streaming and chatbot service. According to the researchers, the extension appends the user’s OAuth token directly to these redirected proxy requests as an auth= URL parameter.

Because the token is placed within the URL query string, it is recorded in cleartext in the proxy server’s request logs. This allows the software vendor to easily retrieve the credentials. This process occurs for every Twitch channel a user watches, except for ten Russian-language channels that are hardcoded into the extension’s code.

Conflicting developer claims

The developer’s disclosures regarding data handling have been inconsistent. In the Firefox Add-ons store, the product description included a disclaimer stating that previous versions of the extension transmitted OAuth tokens to their server, claiming this was necessary for 1080p and 1440p streaming functionality.

In contrast, the data privacy disclosure for the Chrome version of the extension claims that the developer does not collect or use user data, except for approved cases or core functionality. At the time of reporting, the extension remained available in both major browser stores.

Recommended mitigation steps

Security researchers recommend that any users who have installed the extension take the following actions immediately:

• Remove the extension from all browsers.
• Disconnect all active sessions within Twitch settings to invalidate current tokens.
• Re-authenticate to ensure any potentially compromised credentials are no longer valid.