The CVE database does allow "Discoverer(s)/Credits" to be recorded, as shown on the MITRE CVE form:
However, the help for that field states:
Please indicate the individual(s) or organization(s) that found the
vulnerability or reported the vulnerability to you. This information
will not be included in the public CVE entry.
Back in 2000, Steve Christey had this comment on the CVE editorial board mailing list:
With respect to Marcus' comments, it is clear that some vulnerability
discoverers want proper credit for discovering something, and it is
becoming a more common practice (consider Microsoft's acknowledgement
policy and recent SGI advisories).
Which implies that back when CVE started up there was an assumption that discoverers didn't want credit. Today, that seems strange; reporting vulnerabilities - responsibly - is a respectable job which you can even get paid for. But 25 years ago, that was far from the case. People could rightly fear legal reprisals, and reputational damage, if they were responsible for publishing a vulnerability. For how would they ever have found it if they were not evil hackers?
The CVE process has been one of several agents of change, making it possible to "own" discovery of a vulnerability more easily today.
The common method of attribution is via the announcement; and in many cases, the References field of the CVE (which is public) will point to the original advisory announcement. (I seem to recall 8lgm had noteworthy 'tude on their releases back in the 90s). The recent trend of fancy ALLCAPS vuln names with trendy websites is just more of the same.
(This leaves unanswered how to convince a 3rd party (well, 4th - Discoverer/Reporter, MITRE/CNA, Vendor - those three talk. You're asking about someone separate from those three, and I don't know the answer to that.)