Twitch Extension With 30K Installs Exposes Users' OAuth Tokens

Twitch "Quality of Life" Extension Was Quietly Leaking Session Tokens

A browser extension called Twitch Enhanced Viewer | JeetBot, available in both the official Chrome Web Store and Firefox Add-ons store, has been forwarding users' Twitch OAuth session tokens to the infrastructure of a commercial streaming bot service, according to research published by Socket's Threat Research Team on September 11, 2026. The extension markets itself as a legitimate quality-of-life tool — blocking ads, forcing 1080p playback, unlocking region-locked streams, and auto-collecting channel points — but that functionality has been riding on a mechanism that also exposes the OAuth token tied to a user's Twitch account.

Incident Summary

What Happened

According to Socket, the extension's current release line (v85.x) works by redirecting Twitch's video-playlist requests through proxy servers operated by JeetBot in order to deliver its ad-blocking and stream-unlocking features. The user's live Twitch OAuth token rides along on that redirect, appended inline as an auth= query parameter — for every channel the user watches, except a hardcoded allow-list of ten Russian streamer channels, whose sessions are exempted from forwarding. Socket flagged that selective carve-out as evidence the token collection was a deliberate design choice rather than an accidental side effect.

Socket's analysis also traced the behavior back further: an earlier release, version 4.8 from January 2026, was more explicit about it, POSTing captured tokens directly to a /set-token endpoint hosted on JeetBot's own infrastructure, with backup endpoints hosted on Deno Deploy. That earlier code tracked which tokens it had already sent and applied a five-second cooldown before resending one — again pointing to intentional, systematic collection rather than a one-off bug.

Socket also noted that the extension's own store listing disclosures claim it does not collect, store, or process user data — a claim that conflicts with the behavior researchers observed.

Risk to Users

A Twitch OAuth session token functions as a bearer credential: whoever holds it can act on the account without needing the password or a second authentication factor. Per Socket's writeup, that access could be used to read and send whispers (private messages), post in chat as the account holder, and spend the account's channel points. BleepingComputer's coverage of the disclosure echoes the same set of capabilities.

Because the tokens were reportedly captured and logged on proxy infrastructure the extension's operator controls, simply updating or removing the extension after the fact does not undo exposure of tokens that were already sent — those sessions need to be explicitly invalidated (see below).

Developer Response

The JeetBot service's site identifies its operator as Aleksandr Popov. BleepingComputer said it contacted JeetBot support at the email address listed in the extension's Chrome Web Store page but had not received a response as of publication. Separate reporting on the disclosure quotes Popov describing the OAuth forwarding as "an oversight," saying the token was needed to retrieve stream playlists and was "not used for any kind of unauthorized account activity."

Following the disclosure, JeetBot's own documentation site posted an update stating that version 85.8.7 of the Firefox add-on no longer sends the OAuth token to its proxy servers, with a corresponding fix for the Chrome build described as pending store review. As of publication, both the Chrome and Firefox listings remained available for install.

No official statement from Twitch has been reported in connection with this disclosure.

What Users Should Do

• Uninstall Twitch Enhanced Viewer | JeetBot if you have it installed — a version update alone does not revoke tokens that were already exposed
• Sign out of Twitch everywhere: go to Twitch account Security settings and use the option to end all active sessions, which invalidates any OAuth tokens already sent to JeetBot's proxy logs
• Change your Twitch password as an added precaution
• Enable two-factor authentication on your Twitch account if it isn't already on
• Review connected third-party apps/extensions under Twitch's connections/security settings and revoke anything you don't recognize or no longer use
• Watch your account activity for whispers, chat messages, or channel-point spending you didn't initiate

Why This Matters

This case is a reminder that a browser extension's presence in an official Chrome or Firefox store — and a real, working feature set users actually want — is not proof it's safe. The extension reportedly shipped token-forwarding behavior as far back as its January 2026 (v4.8) release and remained available with over 30,000 combined installs more than a year later, without the store review processes catching the network-layer leak. For gamers and streamers who treat browser extensions as disposable convenience add-ons, it's a concrete illustration of why OAuth tokens and connected-app permissions are worth periodically auditing, not just trusting by default.

Sources

• BleepingComputer — Twitch extension with 30K installs exposes users' OAuth tokens
• Socket — Malicious Twitch Browser Extension Exposes 30,000 Users' OAuth Tokens to Russian Bot Service