Twitch Extension Token Leak Hits 31K Users

A Twitch playback helper distributed through both the Chrome Web Store and Firefox Add-Ons store has been forwarding viewers' live OAuth session tokens to proxy infrastructure controlled by a commercial bot operator, according to an analysis published by Socket. The same extension has been downloaded by tens of thousands of users and, as of the source report, remained available in both stores.

The extension, named Twitch Enhanced Viewer | JeetBot, lists HISHIMIRO/jeetbot.cc as its developer. Socket's review describes a token-forwarding mechanism that activates for every channel a user watches, with one narrow exception. The report's central claim comes from a single security firm and has not been independently corroborated.

Two stores, one extension

The add-on exists under separate identifiers on each browser's store. On the Chrome Web Store, it is listed as pnhhdhhcadcjfckjhpmjneldiegbojfb, with 30,000 users and a publication date of June 26, 2025. On Mozilla's Firefox Add-Ons store, it appears as twitchenhancedviewer@example.com, with 604 users and a publication date of July 7, 2025.

Both listings were still live at the time Socket's findings were published. The Chrome entry alone accounts for the large majority of the affected install base, and the combined figure cited by Socket across both stores is approximately 31,000 users.

The listing text pitches the extension as a viewing upgrade rather than a credential-relay tool: "JeetBot is a modern tool for streamers and viewers who appreciate quality, convenience, and control," it reads, adding that it "expands Twitch capabilities: 1080p stream for regions with constraints."

How the token forwarding worked

According to Socket security researcher Kush Pandya, the current build forwards the credential inline rather than through a separate exchange. In the v85.x line, the token is appended as an &auth= query parameter on a network-layer redirect to the operator's proxy.

"Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy," Socket security researcher Kush Pandya said. "The token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels, whose sessions are exempted from forwarding."

Pandya also characterized the party receiving the tokens: "The operator is a commercial Twitch, Kick, and VK Live bot SaaS that has broad Twitch host permissions and relays live authenticated sessions through its own infrastructure."

Functionally, the extension is described as routing Twitch's video-playlist requests to usher.ttvnw[.]net through operator-controlled proxy servers, carrying the viewer's OAuth token along in the query string. The add-on embeds code to recover the Twitch OAuth token and transmit it to the proxy, per the report.

Because the token travels in the URL query string, it is written in cleartext into the proxy server's request logs. A bearer credential of that kind can grant access to a user's chat, whispers, and account settings, according to Socket.

Ten channels left out

The forwarding mechanism excluded a hardcoded list of ten Twitch channels, most of them Russian-language streamers with substantial followings. Socket's report lists them with follower counts as follows:

• pch3lk1n — 580K followers
• fasoollka — 361K followers
• flamie — 132K followers
• dosia — 29 followers
• fander — 2 followers
• almazer — 4 followers
• forzorezor — 177K followers
• akyuliych — 1.1M followers
• lagoda1337 — 225K followers
• lagoda — 77.3K followers

Pandya described the scope of the exemption plainly: "For every channel outside this list, the user's live token is forwarded to the proxy." He added that earlier builds behaved differently, writing that v4.x builds such as version 4.8 from January 2026 went further by POSTing the token to a dedicated set-token endpoint on the operator host, with backups on deno.dev and deno.net.

What the operator says

JeetBot markets itself as a "powerful bot for Twitch, Kick and VK Live with message speech synthesis, automatic translation, and many other features to enhance interaction with viewers." It claims over 26,000 active streamers and 1 billion processed messages. The site's footer identifies the operator as a Cyprus-based developer named Aleksandr Popov, who lists JeetBot as a pet project on LinkedIn.

The developer has already moved to change the implementation. An alert on the JeetBot documentation page states that version 85.8.7 of the Firefox add-on addresses the issue and that an equivalent Chrome version is under review. The notice reads:

In the previous implementation, the extension sent the user's Twitch OAuth token to our proxy servers to retrieve stream playlists. An OAuth token is a credential and must be protected.

Version 85.8.7 changes how playlists are retrieved: the user's OAuth token is no longer sent to our proxies.

Check your installed extension version and update to 85.8.7 or later. Older installations using the previous mechanism continue to send the token until updated.

The documentation urges users to temporarily disable the extension to halt further transmission of the token if an update is not available. It also warns that disabling or updating does not revoke tokens that were already transmitted.

Contacted for comment, Popov told The Hacker News that the token exfiltration was an oversight addressed in the latest versions. He said a Chrome update has been submitted and is awaiting Chrome Web Store review.

"We appreciate Socket drawing attention to the token-handling and disclosure concerns," Popov said. "We have taken those concerns seriously and changed the extension's implementation. We acknowledge that the previous description and privacy policy did not adequately explain the transmission of Twitch OAuth tokens to our proxy servers. That was an oversight on our part, and we take responsibility for it."

Asked about the ten exempted channels, Popov described the list as part of a playback workaround for an error viewers reported when trying to watch those channels outside Russia or over a VPN. Twitch's player displayed the message: "A proxy or unblocker has been detected. This premium content will not be available to you while it is in use. (Error #3)"

According to Popov, the alternative playback path for those channels did not require forwarding the viewer's OAuth token, so the extension omitted it when routing requests that way. He said the ten channels were the default entries for that workaround, based on viewer reports, and that from version 85.8.4 users could add or remove channels through a "Channels with restrictions" setting in the extension. He described it as a user-adjustable playback setting rather than a fixed exemption.

Popov also said the token forwarding existed to obtain Twitch stream playlists and support playback, and that other Twitch playback extensions — ReYohoho Twitch Proxy, XT Viewer, and ggsel Ханти — have taken similar approaches. He noted that those extensions state in their Chrome Web Store listings that the OAuth token is transmitted to their server to provide "1080p/1440p quality access" for Russian users, and said his own checks observed them transmitting tokens in URL query parameters. "Their use elsewhere does not remove our responsibility to protect credentials and accurately disclose data handling," he said.

He pushed back on the characterization of the extension as malicious, saying its purpose is playback functionality and that forwarded tokens are not used for unauthorized account activity. "We recognize the security risk of the previous design, which is why we removed the need to forward users' OAuth tokens," he added.

What Socket concludes

Socket's summary puts the scope and the nature of the credential in blunt terms: "Approximately 31,000 users across Chrome and Firefox route their live Twitch OAuth session tokens through operator-controlled proxy infrastructure."

The firm's analysis also focuses on what the credential permits. "A Twitch OAuth session token is a bearer credential: whoever holds it can act on the account without the password or a second factor, including reading and sending whispers, posting in chat, and spending channel points. The exposure is undisclosed in both store listings," Socket said.

The report notes that the token can enable access to a user's chat, private messages sent as whispers, and account settings. It also notes that the extension's store listings did not disclose the token transmission.

The numbers at stake

Several figures in the report frame the scale of the exposure:

• 31,000 — approximate number of users across Chrome and Firefox whose live OAuth tokens route through operator-controlled proxy infrastructure, per Socket
• 30,000 — Chrome Web Store user count for the extension
• 604 — Firefox Add-Ons user count for the extension
• 85.8.7 — Firefox version that removes token forwarding, per the JeetBot documentation
• 4.8 — example of an earlier build (January 2026) that POSTed tokens to a dedicated endpoint
• 10 — number of channels on the hardcoded exemption list

What affected users can do

The developer's documentation states that older installations continue sending tokens until updated, and that disabling or updating does not undo previously transmitted credentials. The notice directs users to check their installed version and move to 85.8.7 or later, and to temporarily disable the extension if an update is not yet available to stop further transmission.

The available source material does not include instructions for revoking a token, so any account-protection steps beyond those stated by the developer and Socket are not described here.

Why it matters beyond Twitch

The episode highlights a structural tension that browser extensions and the platforms they extend have long shared: a tool that adds features the platform does not provide often needs access to the same credentials the platform issues. When that access is handled through a redirect with a bearer token in the query string, the credential becomes visible to the party operating the redirect, and the store listings may not say so. For viewers, the practical exposure is that a token can act on an account without a password or second factor. For Twitch, the case suggests a gap between what platform-level controls can see and what an extension with broad host permissions can do with authority the platform granted it. For users of any playback or enhancement add-on, the takeaway is narrower and more actionable: check what a listing discloses about credential handling, and treat an undisclosed token transmission as a reason to reconsider the install.