CVE-2026-121652 is a stored cross-site scripting (XSS) vulnerability in the AWS Amplify library maplibre-gl-js-amplify, which integrates Amazon Location Service with MapLibre GL JS. The flaw affects popup and geofence-control rendering, allowing malicious scripts to be stored and executed in web applications using versions up to 4.0.2.