Twitch Extension Forwarded OAuth Tokens to External Proxies

The extension, named Twitch Enhanced Viewer - JeetBot, was published by HISHIMIRO and jeetbot.cc on both the Chrome Web Store and Mozilla Firefox Add-ons.

According to published figures:

• The Chrome version had approximately 30,000 users;
• The Firefox version had more than 600 users.

JeetBot promoted the extension as a tool designed to improve the Twitch viewing experience, including support for higher-quality streaming and access to content affected by regional restrictions.

However, researchers at Socket Security found that earlier versions of the extension retrieved users' Twitch OAuth tokens and transmitted them to proxy servers controlled by the operator.

OAuth Tokens Were Included in Network Requests

According to Socket Security, versions in the 85.x branch forwarded the OAuth token together with video playlist requests when Twitch traffic was routed through JeetBot-controlled proxy infrastructure.

This creates a significant security risk because authentication data may be recorded in:

• Proxy logs;
• Web server logs;
• Reverse proxy logs;
• Network monitoring systems.

If the token is stored in infrastructure logs, anyone with access to those logs may potentially gain access to the user's authentication credential.

OAuth Tokens Can Provide Account Access

A Twitch OAuth token is a bearer credential. Anyone who obtains a valid token may be able to act on behalf of the user without necessarily knowing the account password.

Depending on the permissions associated with the token, an attacker may be able to:

• Read or send private messages;
• Post messages in Twitch chat;
• Access certain account settings;
• Interact with authenticated Twitch services;
• Perform other actions within the token's authorized scope.

The main concern is that users may have been unaware that their authentication tokens were being transmitted through third-party infrastructure.

Some Twitch Channels Were Excluded

Researchers also found that the token-forwarding mechanism did not apply to a specific group of Twitch channels, many of which belonged to Russian-speaking streamers.

The JeetBot developer explained that the list was part of a playback workaround used when Twitch detected VPN or proxy connections and restricted access to certain content.

Under that alternative playback method, forwarding the user's OAuth token was not required.

Starting with version 85.8.4, users could manually add or remove channels from the restricted-channel list through the extension settings.

Updated Version Removes Token Forwarding

Following disclosure of the issue, JeetBot changed the way the extension retrieves Twitch playlists.

Firefox version 85.8.7 no longer sends users' OAuth tokens to JeetBot proxy servers.

The developer also stated that an equivalent update for Chrome had been submitted to the Chrome Web Store for review.

JeetBot acknowledged that the previous implementation created a security risk and that the extension description and privacy policy had not clearly disclosed how OAuth tokens were being transmitted.

Updating the Extension Does Not Revoke Previously Exposed Tokens

An important detail is that:

• Updating the extension;
• Disabling the extension;
• Uninstalling the extension

does not automatically revoke OAuth tokens that may already have been transmitted.

Users who previously installed affected versions should consider:

• Updating to the latest version;
• Signing out of active Twitch sessions;
• Signing in again to establish a new session;
• Reviewing applications connected to the account;
• Monitoring the account for suspicious activity.

Browser Extensions Can Introduce Significant Security Risks

The JeetBot incident demonstrates how browser extensions can have extensive access to user activity.

Depending on their permissions, extensions may interact with:

• Network requests;
• Browser storage;
• Cookies;
• Authentication tokens;
• Web page content;
• API traffic.

The presence of an extension on the Chrome Web Store or Mozilla Firefox Add-ons marketplace does not guarantee that every aspect of its implementation is secure.

What Users Should Do

Users should exercise particular caution with extensions that interact with authenticated services, streaming platforms, or online accounts.

Recommended practices include:

• Install extensions only from trusted developers;
• Review requested permissions carefully;
• Read privacy policies before installation;
• Periodically audit installed browser extensions;
• Remove extensions that are no longer needed;
• Revoke active sessions if credentials may have been exposed.

The JeetBot case shows how a feature intended to support video playback can become a serious security issue when user credentials are routed through third-party infrastructure without appropriate protection.

OAuth tokens should be protected with the same level of care as passwords. Anyone who obtains a valid bearer token may be able to act on behalf of the user within the permissions granted to that token.