lib/omniauth/failure_endpoint.rb in OmniAuth prior to 1.9.2 (and prior to 2.0) does not escape the message_key value.
omniauth omniauth