"The token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels," Socket security researcher Kush Pandya said.
JeetBot's token-forwarding mechanism
The browser extension marketed as "Twitch Enhanced Viewer | JeetBot" embeds code that recovers a user's Twitch OAuth token and routes video-playlist requests through operator-controlled proxy servers. Current builds (v85.x) place the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy, according to Socket and researcher Kush Pandya. Because the token is put in the URL query string, it is written in cleartext into the proxy server's request logs.
The extension routes the Twitch playlist requests to "usher.ttvnw[.]net" through the proxy along with the user's OAuth token. Earlier v4.x builds — for example version 4.8 from January 2026 — reportedly POSTed the token to a dedicated set-token endpoint on the operator host, with backups hosted on deno.dev and deno.net.
Scope of exposure: approximately 31,000 users and what the tokens permit
Socket estimated that "approximately 31,000 users across Chrome and Firefox route their live Twitch OAuth session tokens through operator-controlled proxy infrastructure." The extension listings show a Chrome package (ID pnhhdhhcadcjfckjhpmjneldiegbojfb) with about 30,000 users (published on June 26, 2025) and a Firefox add-on (twitchenhancedviewer@example.com) with 604 users (published on July 7, 2025). Both extensions were still available for download at the time of reporting.
Socket warned that a Twitch OAuth session token is a bearer credential: "whoever holds it can act on the account without the password or a second factor, including reading and sending whispers, posting in chat, and spending channel points." The extension's store listings do not disclose the exposure of these tokens, Socket said.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThe operator, claims, and the ten-channel allowlist
The extension lists HISHIMIRO/jeetbot.cc as its developer and promotes JeetBot as a "powerful bot for Twitch, Kick and VK Live" offering features such as message speech synthesis, automatic translation, ad-free experience and "1080p stream for regions with constraints." The JeetBot site claims over 26,000 active streamers and one billion processed messages; its footer identifies a Cyprus-based developer named Aleksandr Popov, who on LinkedIn describes JeetBot as a pet project.
Pandya and Socket describe the operator as a commercial Twitch, Kick, and VK-Live bot SaaS with broad Twitch host permissions that relays live authenticated sessions through its own infrastructure. The extension's token forwarding is explicitly excluded for a hard-coded allowlist of ten Twitch channels — most of them Russian-language streamers — whose sessions are exempted from forwarding. The ten channels named in the allowlist and their follower counts are:
- pch3lk1n (580K followers)
- fasoollka (361K followers)
- flamie (132K followers)
- dosia (29 followers)
- fander (2 followers)
- almazer (4 followers)
- forzorezor (177K followers)
- akyuliych (1.1M followers)
- lagoda1337 (225K followers)
- lagoda (77.3K followers)
What this means for technologists, platform operators, and end users
Technologists and security teams should note that the tokens were transmitted in URL query strings and therefore written to proxy request logs; earlier builds used POST endpoints with public backups. That pattern means recorded tokens could persist in multiple places where logs or backups exist. Socket's characterization of a Twitch OAuth token as a bearer credential underscores that possession of the token can allow account actions without passwords or second factors.
Platform operators and CDN operators should be aware that the operator "relays live authenticated sessions through its own infrastructure," per Socket, and that the extension routes requests to usher.ttvnw[.]net via the proxy. The developer-listed operator appears to be a commercial bot service with broad host permissions that supports Twitch, Kick, and VK-Live.
End users are explicitly urged by the developer to check their installed extension versions and update. The JeetBot documentation states that Firefox add-on version 85.8.7 addresses the issue and that an equivalent Chrome update is under review. The documentation also instructs users to temporarily disable the extension if the fixed version is not yet available. Crucially, the developer warned that disabling or updating the extension does not revoke tokens already transmitted.
Developer response and outstanding operational points
The JeetBot documentation posts an alert saying "Version 85.8.7 changes how playlists are retrieved: the user's OAuth token is no longer sent to our proxies." It also acknowledges that "in the previous implementation, the extension sent the user's Twitch OAuth token to our proxy servers to retrieve stream playlists. An OAuth token is a credential and must be protected."
The Hacker News has contacted both Socket and the developer for further comment and said it will update the story if it hears back. For now, the record indicates that nearly 31,000 users routed live Twitch OAuth session tokens through operator-controlled proxy infrastructure; that those tokens were placed in query strings and therefore logged in cleartext on the proxy; and that the developer states the implementation has been changed in version 85.8.7 while cautioning that previously transmitted tokens remain valid until revoked.
