SurrealDB versions before 3.1.0 have a vulnerability in HTTP redirect handling that allows authenticated users to bypass port-specific --deny-net rules. This occurs because the port information is dropped during redirect policy evaluation, enabling redirects from allowed hostnames to denied host:port combinations to be followed.