JeetBot Twitch Extension Sent OAuth Tokens Through Proxy Servers

JeetBot extension exposed Twitch OAuth tokens

A browser extension called Twitch Enhanced Viewer | JeetBot sent Twitch OAuth session tokens from nearly 31,000 users through proxy infrastructure controlled by its operator. Socket researcher Kush Pandya identified the behaviour in the Chrome and Firefox versions of the add-on, which remain available for download.

The Chrome Web Store listing, identifier pnhhdhhcadcjfckjhpmjneldiegbojfb, showed 30,000 users and was published on June 26, 2025. The Firefox Add-Ons listing, identifier twitchenhancedviewer@example.com, showed 604 users and was published on July 7, 2025. Both list HISHIMIRO/jeetbot.cc as the developer.

JeetBot presents itself as a tool for Twitch streamers and viewers, including 1080p streaming for constrained regions. It also advertises functions for Twitch, Kick and VK Live, such as message speech synthesis and automatic translation.

Tokens were included in redirected playlist requests

Socket said v85.x builds recovered the user’s Twitch OAuth token and forwarded it inline as an &auth= query parameter during a network-layer redirect to an operator proxy. The redirection was used for Twitch video-playlist requests directed to usher.ttvnw.net.

Putting a token in a URL query string means it can be recorded in clear text in proxy request logs. Socket characterised the Twitch OAuth session token as a bearer credential: a holder can act on the account without the password or a second factor. The reported scope includes reading and sending whispers, posting in chat, changing account settings, and spending channel points.

The forwarding mechanism did not apply to a hard-coded allowlist of 10 Twitch channels, most of them Russian-language streamers. For channels outside that list, the live token was relayed to the proxy. Pandya also said earlier v4.x releases, including version 4.8 in January 2026, POSTed tokens to a dedicated set-token endpoint on the operator host, with backup endpoints on deno.dev and deno.net.

Updated Firefox build changes the playlist path

An alert on JeetBot’s documentation site states that Firefox add-on version 85.8.7 no longer sends the user’s Twitch OAuth token to its proxies when retrieving playlists. It says an equivalent Chrome release is under review. The documentation advises users to check their installed version and temporarily disable the extension if an updated build is unavailable.

The operator also cautioned that disabling or updating the add-on does not revoke tokens transmitted under the earlier design. For businesses with managed creator, community, or brand accounts, the practical implication is to identify affected installations, update or remove the extension, and revoke or rotate exposed Twitch sessions rather than treating an extension update as sufficient remediation.