python3-pyjwt: fix CVE-2026-102275

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-python/recipes-devtools/python/files/CVE-2026-102275.patch

@@ -0,0 +1,82 @@
+From 3cd9ceec33ced359decbad75b413ad668ae6332c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Padilla?= <jpadilla@users.noreply.github.com>
+Date: Fri, 11 Sep 2026 22:29:12 -0400
+Subject: [PATCH] fix: reject inconsistent OKP private keys
+
+CVE: CVE-2026-102275
+Upstream-Status: Backport [https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c]
+
+(cherry picked from commit 3cd9ceec33ced359decbad75b413ad668ae6332c)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ jwt/algorithms.py        | 14 ++++++++++++--
+ tests/test_algorithms.py | 29 +++++++++++++++++++++++++++++
+ 2 files changed, 41 insertions(+), 2 deletions(-)
+
+diff --git a/jwt/algorithms.py b/jwt/algorithms.py
+index 432fdcf..03976c9 100644
+--- a/jwt/algorithms.py
++++ b/jwt/algorithms.py
+@@ -1036,8 +1036,18 @@ if has_crypto:
+                         return Ed25519PublicKey.from_public_bytes(x)
+                     return Ed448PublicKey.from_public_bytes(x)
+                 d = base64url_decode(obj.get("d"))
++                private_key: Ed25519PrivateKey | Ed448PrivateKey
+                 if curve == "Ed25519":
+-                    return Ed25519PrivateKey.from_private_bytes(d)
+-                return Ed448PrivateKey.from_private_bytes(d)
++                    private_key = Ed25519PrivateKey.from_private_bytes(d)
++                else:
++                    private_key = Ed448PrivateKey.from_private_bytes(d)
++                if (
++                    private_key.public_key().public_bytes(
++                        encoding=Encoding.Raw, format=PublicFormat.Raw
++                    )
++                    != x
++                ):
++                    raise InvalidKeyError("Public key does not match private key")
++                return private_key
+             except ValueError as err:
+                 raise InvalidKeyError("Invalid key parameter") from err
+diff --git a/tests/test_algorithms.py b/tests/test_algorithms.py
+index acaa1fe..089b881 100644
+--- a/tests/test_algorithms.py
++++ b/tests/test_algorithms.py
+@@ -933,6 +933,35 @@ class TestAlgorithmsRFC7520:
+ 
+ @crypto_required
+ class TestOKPAlgorithms:
++    @pytest.mark.parametrize("curve", ("Ed25519", "Ed448"))
++    @pytest.mark.parametrize("as_dict", (False, True))
++    def test_okp_jwk_should_reject_inconsistent_private_key(
++        self, curve: str, as_dict: bool
++    ) -> None:
++        with open(key_path(f"jwk_okp_key_{curve}.json")) as keyfile:
++            jwk = json.load(keyfile)
++
++        d = base64url_decode(jwk["d"])
++        jwk["d"] = (
++            base64.urlsafe_b64encode(bytes([d[0] ^ 1]) + d[1:]).rstrip(b"=").decode()
++        )
++
++        with pytest.raises(InvalidKeyError):
++            OKPAlgorithm.from_jwk(jwk if as_dict else json.dumps(jwk))
++
++    @pytest.mark.parametrize("curve", ("Ed25519", "Ed448"))
++    @pytest.mark.parametrize("length", (0, 1, 56, 58))
++    def test_okp_jwk_should_reject_private_key_with_invalid_public_length(
++        self, curve: str, length: int
++    ) -> None:
++        with open(key_path(f"jwk_okp_key_{curve}.json")) as keyfile:
++            jwk = json.load(keyfile)
++
++        jwk["x"] = base64.urlsafe_b64encode(b"\x00" * length).rstrip(b"=").decode()
++
++        with pytest.raises(InvalidKeyError):
++            OKPAlgorithm.from_jwk(jwk)
++
+     hello_world_sig = b"Qxa47mk/azzUgmY2StAOguAd4P7YBLpyCfU3JdbaiWnXM4o4WibXwmIHvNYgN3frtE2fcyd8OYEaOiD/KiwkCg=="
+     hello_world_sig_pem = b"9ueQE7PT8uudHIQb2zZZ7tB7k1X3jeTnIfOVvGCINZejrqQbru1EXPeuMlGcQEZrGkLVcfMmr99W/+byxfppAg=="
+     hello_world = b"Hello World!"
+-- 
+2.35.6

meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb

@@ -17,6 +17,7 @@ SRC_URI += "file://CVE-2026-48522.patch \
            file://CVE-2026-102268_CVE-2026-102270.patch \
            file://CVE-2026-102271.patch \
            file://CVE-2026-101917.patch \
+           file://CVE-2026-102275.patch \
            "
 
 SRC_URI[sha256sum] = "c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b"