← News
/DISPATCH · 2026-09-15

31,000 Twitch user OAuth tokens leaked: JeetBot browser extension sent session credentials to a Russian proxy

Security vendor Socket disclosed that Twitch Enhanced Viewer | JeetBot forwarded ~31,000 users' Twitch OAuth session tokens as plaintext URL parameters to operator-controlled proxy servers, and hardcoded an allowlist of 10 Russian-language streamer channels. The token is an account-level credential; no password or 2FA required to operate the account.

Security vendor Socket on 11 Sep 2026 disclosed that Twitch Enhanced Viewer | JeetBot, listed on both the Chrome Web Store and Firefox Add-ons, forwarded ~31,000 users' Twitch OAuth session tokens as plaintext URL query parameters to operator-controlled proxy servers run by a Russian commercial bot service. The leaked tokens are account-level bearer credentials. The holder can operate the victim account with no password and no second-factor.

Incident overview

Developer identity: HISHIMIRO / jeetbot.cc. Site footer points to a Cyprus-based developer. Chrome extension ID `pnhhdhhcadcjfckjhpmjneldiegbojfb`, ~30,000 users; Firefox add-on ~604 users. Claimed features: ad stripping, forced 1080p, geo-unlock. Implementation: Twitch video playlist requests (`usher.ttvnw.net`) are proxied through the operator. The leak is in that hop: on redirect, the user's OAuth token is appended as an `&auth=` query parameter, so the token is written in plaintext to the proxy server request logs and retained in the operator's log corpus.

Technical details

Socket researcher Kush Pandya noted that the current v85.x build inlines the token on network-layer redirects for every channel the user watches, with one exception: a hardcoded allowlist of 10 Russian-language streamer channels, including channels with 1.1M, 580k, 360k, and 225k followers. An allowlist that protects a specific language audience while forwarding everyone else is core evidence the behavior is intentional.

`Capture: the extension extracts the Twitch OAuth token from the authenticated session
Delivery: the token is appended as an &auth= query parameter on the redirect URL sent to the operator-controlled proxy
Retention: plaintext tokens are written to the proxy server access log`

The extension does not need this token to function. The playback token required for playback is handled separately; allowlisted channel traffic also goes through the same proxy without the account token. An earlier v4.8 build POSTed the token directly to a dedicated set-token endpoint on the operator domain, with backup nodes on deno.dev and deno.net.

Impact

Twitch OAuth session tokens are not playback tokens. They are account-scoped credentials. The holder can read and send DMs, post in chat, and spend channel points, with no password and no 2FA. Both stores' "data safety" statements claim the extension does not collect, use, or sell user data. Actual behavior was never disclosed. The developer claims Firefox 85.8.7 is fixed and the Chrome build is still in review. As of disclosure both extensions remain downloadable from the stores.

Remediation

Sources