Skip to content
Connect AISign inSign up free

Bug bounty program

LI

Linktree

Open on BugcrowdAtlas
Platform
Bugcrowd
Bounties
Pays
Assets in scope
18
Disclosed reports
6
Subdomains
123

Most upvoted reports6

Most upvoted reports of Linktree
ReportWeaknessDisclosedBountyVotes
Account takeover - improper validation of jwt signature (with regards to experiation date claim)Analysed#1760403Access Control2022-12-26–147
XSS in SocialIcon LinkAnalysed#1698652Cross-site Scripting2022-10-31–106
XSS in linktr.ee - on link thumbnail addingAnalysed#1775162Cross-site Scripting2022-12-06$60069
A malicious admin can be able to permanently disable a Owner(Admin) to access his account#1718574Insecure Direct Object Reference2022-10-25$60055
No validation to Image upload user can upload ( php APK zip files and can be used as storage purpose)#1644062File and Path Handling2022-09-15$75033
[song.link] Open Redirect#1699025Open Redirect2023-01-23–28

Subdomains123

Root
Scope
Name suggests
First seen
Text file123 names
Subdomains of Linktree
NameScopeFirst seen
emded.album.linkNot in the scope2026-11-14
aria.label.album.linkNot in the scope2026-11-14
preview.album.linkstagingNot in the scope2026-11-14
staging.album.linkstagingNot in the scope2026-11-14
v3.staging.album.linkstagingNot in the scope2026-11-14
v3.album.linkNot in the scope2026-11-14
studio.portfolio.artist.linkNot in the scope2026-11-14
preview.artist.linkstagingNot in the scope2026-11-14
staging.artist.linkstagingNot in the scope2026-11-14
v3.staging.artist.linkstagingNot in the scope2026-11-14
v3.artist.linkNot in the scope2026-11-14
www.artist.linkNot in the scope2026-11-14
115.linktree-extensions.comIn scope2026-11-14
2-device3104985-38fc41a4-local.115.linktree-extensions.comdevIn scope2026-11-14
televisores.115.linktree-extensions.comIn scope2026-11-14
118-126dayexchange4.linktree-extensions.comIn scope2026-11-14
121.linktree-extensions.comIn scope2026-11-14
84.121.linktree-extensions.comIn scope2026-11-14
40postgres.84.121.linktree-extensions.comdataIn scope2026-11-14
14b.linktree-extensions.comIn scope2026-11-14
0stveritas.14b.linktree-extensions.comIn scope2026-11-14
210.linktree-extensions.comIn scope2026-11-14
49.210.linktree-extensions.comIn scope2026-11-14
device2280155-9e286465-local.49.210.linktree-extensions.comdevIn scope2026-11-14
240xal35cf.linktree-extensions.comIn scope2026-11-14
73538570523067089054165090673535391493645391677881prism-gw.linktree-extensions.comIn scope2026-11-14
97.linktree-extensions.comIn scope2026-11-14
51.97.linktree-extensions.comIn scope2026-11-14
wwwtsx.51.97.linktree-extensions.comIn scope2026-11-14
aheadmobile09242246893968932336476576160630864478701839776408.linktree-extensions.comIn scope2026-11-14
asia-lync-websex.linktree-extensions.comIn scope2026-11-14
autodiscovder.linktree-extensions.comIn scope2026-11-14
device1367662-6aa5b57d.autodiscovder.linktree-extensions.comIn scope2026-11-14
aws.linktree-extensions.comIn scope2026-11-14
cdmhubdevice2881107-b1dae25-local.aws.linktree-extensions.comdevIn scope2026-11-14
bazzanibrand.linktree-extensions.comIn scope2026-11-14
dsl-65-130autodiscover.bazzanibrand.linktree-extensions.commailIn scope2026-11-14
links.linktree-extensions.comIn scope2026-11-14
prod.linktree-extensions.comIn scope2026-11-14
device3075843-89d1ed22-local.prod.linktree-extensions.comdevIn scope2026-11-14
tracker-customer.linktree-extensions.comIn scope2026-11-14
qa.linktree.comtestNot in the scope2026-11-14
www.qa.linktree.comtestNot in the scope2026-11-14
dev.retool-sandbox.linktree.comdev, testNot in the scope2026-11-14
www.linktree.comNot in the scope2026-11-14
preview.mylink.pagestagingNot in the scope2026-11-14
staging.mylink.pagestagingNot in the scope2026-11-14
v3.staging.mylink.pagestagingNot in the scope2026-11-14
v3.mylink.pageNot in the scope2026-11-14
api.odesli.coapiNot in the scope2026-11-14
api-v3.odesli.coapiNot in the scope2026-11-14
embed.odesli.coNot in the scope2026-11-14
login.odesli.coauthNot in the scope2026-11-14
preview.odesli.costagingNot in the scope2026-11-14
embed.preview.odesli.costagingNot in the scope2026-11-14
staging.odesli.costagingNot in the scope2026-11-14
api.staging.odesli.coapi, stagingNot in the scope2026-11-14
api-v3.staging.odesli.coapi, stagingNot in the scope2026-11-14
embed.staging.odesli.costagingNot in the scope2026-11-14
login.staging.odesli.coauth, stagingNot in the scope2026-11-14
v2.staging.odesli.costagingNot in the scope2026-11-14
v3.staging.odesli.costagingNot in the scope2026-11-14
embed.v3.staging.odesli.costagingNot in the scope2026-11-14
v2.odesli.coNot in the scope2026-11-14
v3.odesli.coNot in the scope2026-11-14
embed.v3.odesli.coNot in the scope2026-11-14

29 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated