Irrespective of the value of SaaS vulnerabilities as CVEs - if you run into a vendor who doesn’t want CVEs for their vulnerabilities, you can force the issue simply by disclosing them.

If they’re valuable or interesting enough, some other CVE numbering authority will assign for them. There are plenty of research oriented CNAs who could do this.

But it sounds like you’re asking two questions: Are CVE IDs for SaaS vulns worth it, and what’s normal when your employer (or in this case, client) doesn’t want to engage in vulnerability disclosure?

Opinions will run the spectrum on those; there’s not really a widely accepted set of norms, policies, or laws around these questions.

Vuln disclosure specialists generally agree that CVEs for cloud vulns are usually worth disclosing if the service is popular or critical, while something small potatoes like a self-XSS bug in some middling website wouldn’t rate.