A browser extension with more than 30,000 installations has exposed users’ Twitch OAuth tokens to a commercial bot service. The extension remained available through the official Chrome and Firefox stores at the time of reporting.
Security researchers found that Twitch Enhanced Viewer | JeetBot extracts authentication data from Twitch requests. It then sends the credentials through third-party proxy servers.
Twitch Extension Collects OAuth Tokens
Twitch Enhanced Viewer | JeetBot presents itself as a tool for improving the streaming platform. Its advertised features include blocking ads and forcing high-resolution video playback.
The extension also claims to bypass regional restrictions and collect channel points automatically. Users can download it through the Chrome Web Store and Firefox Add-ons store.
However, researchers at application security company Socket found concerning behaviour in the extension. It captures the authorization header used by Twitch’s web client and extracts the user’s OAuth token.
The software then sends the Twitch OAuth tokens through proxy servers. JeetBot, a commercial Russian-language streaming and chatbot service, operates those servers.
The company offers tools for Twitch, Kick and VK Live.
Tokens Appear in Proxy Logs
Current versions of the extension redirect Twitch video playlist requests through JeetBot’s proxy infrastructure. During that process, the software adds the token to the redirected URL as an authentication parameter.
As a result, the credentials appear in clear text inside the proxy server’s request logs. The service operator can then retrieve them without needing access to the user’s browser.
This process occurs whenever an affected user watches a Twitch channel. However, the extension excludes ten Russian-language channels listed directly in its code.
Placing sensitive credentials in a URL creates several security risks. Servers, monitoring tools and other systems frequently record complete URLs in their logs.
Therefore, anyone with access to those records may also gain access to the tokens.
Earlier Versions Used Clearer Collection Methods
Socket reported that previous versions of the extension used more direct mechanisms to collect Twitch OAuth tokens.
The developer acknowledged the earlier practice in a description published through the Firefox Add-ons store. According to a machine translation, the developer said the extension transmitted OAuth tokens to its server.
The notice claimed that sending the token was necessary to support streams in 1080p and 1440p resolutions.
However, the Chrome Web Store privacy disclosure presented a different message. It stated that the developer would not collect or use customer data.
The declaration also covered selling information to third parties and transferring it outside the extension’s core functionality.
This apparent contradiction raises further concerns about whether users received accurate information about how the software handled their credentials.
Exposed Tokens Create Account Risks
OAuth tokens allow applications to access user accounts without repeatedly asking for a password. Their exact capabilities depend on the permissions granted during authentication.
If someone steals a valid token, they may use it to interact with the associated account. In some cases, the attacker can maintain access until the token expires or the service invalidates it.
Changing an account password may not always terminate every active session immediately. Therefore, affected users should revoke existing sessions and authenticate again.
The incident also shows the risks of routing authenticated traffic through third-party systems. Even when a service does not actively steal credentials, insecure logging can still expose them.
Developers should remove authorization headers and tokens before redirecting requests to external infrastructure. They should also avoid including secrets in URL parameters.
Extension Remains in Official Stores
At the time of publication, Twitch Enhanced Viewer | JeetBot remained available through both official browser extension stores.
Its presence in these marketplaces may have encouraged users to trust the software. However, official distribution does not guarantee that an extension handles sensitive information securely.
The publisher had not responded to questions about the findings by the time the report appeared.
Socket considers the extension a security risk. Consequently, its researchers recommend removing it from every affected browser.
Users should then disconnect all active Twitch sessions before signing in again. This action should invalidate any OAuth token that the extension may have transmitted.
Affected users should also review connected applications and remove services they no longer recognise or use.
0 responses to “Twitch Extension Exposes OAuth Tokens From 30,000 Users”