Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

Summary: A Twitch browser extension called "Twitch Enhanced Viewer | JeetBot," listed under developer HISHIMIRO/jeetbot.cc on the Chrome Web Store and Firefox Add-Ons store, forwarded the Twitch OAuth tokens of nearly 31,000 users to proxy servers run by a Russian commercial bot service. Socket researcher Kush Pandya found that v85.x builds send the token as an &auth= query parameter on a network-layer redirect for every channel watched except a hardcoded list of ten Russian streamer channels, and earlier v4.x builds POSTed the token to a dedicated set-token endpoint with backups on deno.dev and deno.net.
What's compelling: A Twitch OAuth token is a bearer credential: whoever holds it can read and send whispers, post in chat, and spend channel points without the password or a second factor, and the developer acknowledged that updating or disabling the extension does not revoke tokens already transmitted.

Read the original at The Hacker News ↗