As Coleman's answer suggests, the most common cause for this I've seen is a mismatch between the URLs CiviCRM is configured to use and the ones it actually uses.
Other places to check are -
- your webserver configuration (eg a canonical URL redirect)
- the
CIVICRM_UF_BASEURL
constant incivicrm.settings.php
- Administer > System Settings > Resource urls as Coleman mentions
If your site DB has been migrated to your VM, you may also need to follow the steps in Moving an existing CiviCRM installation.
If these various settings don't match, CiviCRM doesn't recognise / receive its session identifiers, and the result is this confusing (and often reported) error message.