diff --git a/meta-python/recipes-devtools/python/python3-pyjwt/CVE-2026-102275.patch b/meta-python/recipes-devtools/python/python3-pyjwt/CVE-2026-102275.patch
new file mode 100644
index 0000000000..9d281bee1b
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-pyjwt/CVE-2026-102275.patch
@@ -0,0 +1,81 @@
+From 64f02b83a79f25b687eaf990f7f871ece4faea8f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Padilla?= <jpadilla@users.noreply.github.com>
+Date: Wed, 14 Oct 2026 05:12:30 -0700
+Subject: [PATCH] fix: reject inconsistent OKP private keys
+
+CVE: CVE-2026-102275
+Upstream-Status: Backport [https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c]
+
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ jwt/algorithms.py        | 14 ++++++++++++--
+ tests/test_algorithms.py | 29 +++++++++++++++++++++++++++++
+ 2 files changed, 41 insertions(+), 2 deletions(-)
+
+diff --git a/jwt/algorithms.py b/jwt/algorithms.py
+index fcfca89..38c0a2e 100644
+--- a/jwt/algorithms.py
++++ b/jwt/algorithms.py
+@@ -893,8 +893,18 @@ if has_crypto:
+                         return Ed25519PublicKey.from_public_bytes(x)
+                     return Ed448PublicKey.from_public_bytes(x)
+                 d = base64url_decode(obj.get("d"))
++                private_key: Ed25519PrivateKey | Ed448PrivateKey
+                 if curve == "Ed25519":
+-                    return Ed25519PrivateKey.from_private_bytes(d)
+-                return Ed448PrivateKey.from_private_bytes(d)
++                    private_key = Ed25519PrivateKey.from_private_bytes(d)
++                else:
++                    private_key = Ed448PrivateKey.from_private_bytes(d)
++                if (
++                    private_key.public_key().public_bytes(
++                        encoding=Encoding.Raw, format=PublicFormat.Raw
++                    )
++                    != x
++                ):
++                    raise InvalidKeyError("Public key does not match private key")
++                return private_key
+             except ValueError as err:
+                 raise InvalidKeyError("Invalid key parameter") from err
+diff --git a/tests/test_algorithms.py b/tests/test_algorithms.py
+index c843903..afc569b 100644
+--- a/tests/test_algorithms.py
++++ b/tests/test_algorithms.py
+@@ -906,6 +906,35 @@ class TestAlgorithmsRFC7520:
+ 
+ @crypto_required
+ class TestOKPAlgorithms:
++    @pytest.mark.parametrize("curve", ("Ed25519", "Ed448"))
++    @pytest.mark.parametrize("as_dict", (False, True))
++    def test_okp_jwk_should_reject_inconsistent_private_key(
++        self, curve: str, as_dict: bool
++    ) -> None:
++        with open(key_path(f"jwk_okp_key_{curve}.json")) as keyfile:
++            jwk = json.load(keyfile)
++
++        d = base64url_decode(jwk["d"])
++        jwk["d"] = (
++            base64.urlsafe_b64encode(bytes([d[0] ^ 1]) + d[1:]).rstrip(b"=").decode()
++        )
++
++        with pytest.raises(InvalidKeyError):
++            OKPAlgorithm.from_jwk(jwk if as_dict else json.dumps(jwk))
++
++    @pytest.mark.parametrize("curve", ("Ed25519", "Ed448"))
++    @pytest.mark.parametrize("length", (0, 1, 56, 58))
++    def test_okp_jwk_should_reject_private_key_with_invalid_public_length(
++        self, curve: str, length: int
++    ) -> None:
++        with open(key_path(f"jwk_okp_key_{curve}.json")) as keyfile:
++            jwk = json.load(keyfile)
++
++        jwk["x"] = base64.urlsafe_b64encode(b"\x00" * length).rstrip(b"=").decode()
++
++        with pytest.raises(InvalidKeyError):
++            OKPAlgorithm.from_jwk(jwk)
++
+     hello_world_sig = b"Qxa47mk/azzUgmY2StAOguAd4P7YBLpyCfU3JdbaiWnXM4o4WibXwmIHvNYgN3frtE2fcyd8OYEaOiD/KiwkCg=="
+     hello_world = b"Hello World!"
+ 
+-- 
+2.35.6
diff --git a/meta-python/recipes-devtools/python/python3-pyjwt_2.8.0.bb b/meta-python/recipes-devtools/python/python3-pyjwt_2.8.0.bb
index f260bb1817..c235499d24 100644
--- a/meta-python/recipes-devtools/python/python3-pyjwt_2.8.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pyjwt_2.8.0.bb
@@ -17,6 +17,7 @@ SRC_URI += " \
     file://CVE-2026-102268_CVE-2026-102270.patch \
     file://CVE-2026-102271.patch \
     file://CVE-2026-101917.patch \
+    file://CVE-2026-102275.patch \
 "
 SRC_URI[sha256sum] = "57e28d156e3d5c10088e0c68abb90bfac3df82b40a71bd0daa20c65ccd5c23de"