A Twitch extension forwarded 30,000 users' OAuth tokens to proxies

On 11 September 2026 Socket published research on a browser extension called Twitch Enhanced Viewer (also named JeetBot). Socket says it forwards each user's live Twitch OAuth session token to proxy servers run by the JeetBot service. The Chrome listing had about 30,000 users and the Firefox listing 552.

What happened

The extension is marketed as a quality of life tool that blocks ads, forces 1080p, unlocks regions and collects channel points. Socket says it does this by redirecting video playlist requests through operator controlled proxies. To make that work it reads the Twitch OAuth token from the page's Authorization header. Current builds append the token as an auth query parameter on proxied requests, for every channel except a hardcoded list of ten. Earlier 4.x builds sent the token to a set-token endpoint.

The developer's privacy policy says the extension does not collect, store or process any user data. Socket says the forwarding contradicts that. Socket calls a Twitch OAuth token a bearer credential, meaning whoever holds it can use it.

Updates to the article: Firefox 85.8.7 was noted on 16 September and Chrome 85.8.9 on 25 September, with the fix live on the Chrome Web Store. Both listings were live when Socket wrote, and older installs stay exposed until they update.

Confirmed, reported and unknown

Reported by Socket from code analysis: the forwarding, the parameters, the default proxy domain and the fixed versions.

Socket infers a server side token store from deduplication and cooldown logic but does not confirm it. Unknown: whether the operator stored or used the tokens, whether any account was compromised, why ten channels are exempt, and the full response from the operator. Socket says the JeetBot team acknowledged the risk, without further detail.

I have left out the individual named in the service's site footer. The article is about the product behavior, and a name on a footer is not evidence of who acted.

What to do now

1. Check for the extension in every browser profile and update or remove it.
2. Revoke the session. In Twitch, sign out of all sessions and review the connected applications list, which invalidates tokens issued earlier.
3. Change the account password and confirm two factor authentication is on.
4. For a company with streamers or community managers on shared machines, add the extension ID to your browser blocklist.

How this could have been avoided

• Do not install extensions that proxy a site's own traffic. A tool that reroutes video requests must see the credentials in them.
• Compare an extension's privacy statement with its network behavior. A policy saying no data is processed on an extension that rewrites requests is a mismatch.
• Use browser enterprise policy to allow only reviewed extensions on machines with logged in business accounts.
• Platforms can bind session tokens to the client or shorten their lifetime so a forwarded token has less value.

Quick check

Sources

• Socket: Twitch browser extension exposes 30,000 users' OAuth tokens to Russian bot service