Currently, an authentication request can not return images from the getFieldInfo method, which is required, e.g., in the PasswordlessLogin extension and probably also in the MediaWiki-extensions-OATHAuth extension if it would use the LinkAccounts special page, in order to show a QR code which can be scanned by a phone.

The FancyCaptcha module of the ConfirmEdit (CAPTCHA extension) extension does this already by using the AuthChangeFormFields hook, which is probably a bit too complex for most use cases. Having a separate field type of image, which just takes a src (can be a link, or probably a data uri), sounds reasonable.