They don't care? Full disclosure then.
They then take time to repeatedly contact you with sufficient documentation and the offer for more of their time for free to walk you through it. Twice. Security consultants get paid a lot of money and this service is offered for free of charge because of some hackers curiosity.
The next step is not usually full disclosure but often, "I have written this blog post detailing the vulnerability and intend to post it in N days unless I hear from you" Then it is pretty fair game for full disclosure.
Assume for the sake of argument that Nexmo is based in the UK. Using this exploit to access someone else's Nexmo.com account would be a violation of the Computer Misuse Act.
Writing a blog post detailing exactly how you achieved this would be a public admission of violating the Computer Misuse Act.
Another example: Person A publishes instructions detailing how to exploit this issue. Person B follows the steps, and causes financial harm to Nexmo. Nexmo sues Person B for exploiting their systems, and also names Person A in the lawsuit because their publication led directly to Person B's actions.
I'm not certain either of these cases would hold up in court, but there is certainly a risk that Nexmo would take the second approach. In the OP's shoes, the safest thing is not to publish. I'm not saying that's the right choice - just the safest from a legal perspective.