Thanks for the report! As mentioned in the discussion, the problem is probably that we set cors="anonymous" on the image (so that we can use an AJAX request and get progress information, timing data etc) but that prevents cookies from being sent. MediaViewer should detect whether img_auth.php is used (there is no great way to do this so probably just add a config flag that users can set) and use full CORS (or maybe none at all) in that case.

I confirm that the solution of @Tgr works still with Mediawiki 1.31-rc0:

L104-L106 of mmv.Provider.js needs to change from:

if ( cors && this.needsCrossOrigin() ) {
        img.crossOrigin = 'anonymous';
}

to

if ( cors && this.needsCrossOrigin() ) {
        img.crossOrigin = 'use-credentials';
}

Now that MultimediaViewer is going to be bundled by default it seems important to this work out of the box.

IMHO we in need of a $wgPrivateWiki = true; or similar variable so we can start fixing up the compatibility problems with private wikis. I think the technical debt here is growing on a number of extensions. As part of the "better wiki out of the box project" this would seem like a key win for a number of end-users (office-wiki application).

By default, it should probably go in the other direction (T64469: MultimediaViewer should work (or at least fail more gracefully) on wikis where the images have no CORS headers), but yeah, a $wgPrivateWiki (or just User::isEveryoneAllowed( 'read' )) would make sense.

This remains an issue today. Is there any progress made on this?

No progress, otherwise progress would be listed here. In general, MultimediaViewer does not receive much development these days.

As of today, I think this issue still persists. I got same error when I tried to view an image in Multimedia Viewer.

Edit: I've just discovered that it might be related to CORS. When I first load the page that image located there is no errors in console, but when I click image to view it in MM Viewer, it shows:

Ensure CORS response header values are valid

I'm using $wgForeignFileRepos to share images with my secondary wiki in my wiki family. Even after settings up $wgCrossSiteAJAXdomains, this error shows up.

See also: T136207#4237310

What if... we check wgUploadPath and see if it contains img_auth.php, then forward the outcome as "wgMMVRequiresCredentials' in the config ?